Is there a fix for CVE-2026-125368 in OmniAgent?

VulnCheck's advisory for CVE-2026-125368 lists OmniAgent as affected through commit 12b98c5 and states no fixed version. Until the project ships one, treat the ReflexionAgent approval prompt as an advisory control rather than a boundary, and avoid pointing the agent at content an attacker can write, such as issues, pull requests or fetched pages.

Why does find -execdir bypass OmniAgent's approval check?

OmniAgent's _is_safe_bash_command decides a command is safe from its leading program name, so anything starting with find passes. The find utility's -execdir flag then runs a program the caller names, which means the approval gate waves through a command that executes an arbitrary binary. VulnCheck names dd, nc, perl and openssl as examples.

Which OmniAgent component holds the vulnerable check?

The check lives in ReflexionAgent._is_safe_bash_command, and its only caller is the agent's bash approval path. VulnCheck's advisory points at the vulnerable source line at commit 12b98c5 and at upstream GitHub issue 67 on the OmniAgent repository. Reaching the flaw needs something able to steer the agent, which VulnCheck describes as prompt injection.

MEDVulnerability

OmniAgent: find -execdir runs commands past the approval gate

CVE-2026-125368 lets a steered OmniAgent run arbitrary binaries, because its safe-command check never reads find's -execdir flag.

November 9, 2026 · VulnCheck · Research by George Chen

CVE-2026-125368

OmniAgent Bash Approval Gate Bypass via find -execdir in Safe-Command Allowlist

MEDVulnerability

OmniAgent treats any shell command starting with find as safe, so a prompt-injected agent can use find -execdir to run binaries with no human approval. VulnCheck published the advisory, credited to George Chen, on November 9.

01What happened

VulnCheck published an advisory for CVE-2026-125368 in OmniAgent on November 9, 2026, crediting the finding to George Chen. OmniAgent is an open-source agent framework whose ReflexionAgent asks for human approval before it runs shell commands. VulnCheck rates the flaw high, with a CVSS 4.0 base score of 7.7.

02How it works

ReflexionAgent's _is_safe_bash_command check classifies any command beginning with find as safe and never inspects the arguments that follow. Because find's -execdir flag runs a program of the caller's choosing, such a command reaches an unsandboxed shell with no approval prompt. VulnCheck says an agent under prompt injection can use it to run binaries including dd, nc, perl and openssl, overwriting files or executing code.

03Who is affected

OmniAgent through commit 12b98c520959eff88a6cfa3dd233497084360ab0 is affected, and VulnCheck's advisory states no fixed version. The weakness is classed as CWE-184, an incomplete list of disallowed inputs, and the CVSS vector records no privileges required and passive user interaction.

04What to do

Treat OmniAgent's bash approval prompt as an advisory control rather than a boundary until a fix ships, and do not let the agent read untrusted content while it can run shell commands. Where an allowlist decides what runs without a prompt, match the whole command including flags such as -exec and -execdir, not the leading program name.

Questions people ask

Is there a fix for CVE-2026-125368 in OmniAgent?: VulnCheck's advisory for CVE-2026-125368 lists OmniAgent as affected through commit 12b98c5 and states no fixed version. Until the project ships one, treat the ReflexionAgent approval prompt as an advisory control rather than a boundary, and avoid pointing the agent at content an attacker can write, such as issues, pull requests or fetched pages.
Why does find -execdir bypass OmniAgent's approval check?: OmniAgent's _is_safe_bash_command decides a command is safe from its leading program name, so anything starting with find passes. The find utility's -execdir flag then runs a program the caller names, which means the approval gate waves through a command that executes an arbitrary binary. VulnCheck names dd, nc, perl and openssl as examples.
Which OmniAgent component holds the vulnerable check?: The check lives in ReflexionAgent._is_safe_bash_command, and its only caller is the agent's bash approval path. VulnCheck's advisory points at the vulnerable source line at commit 12b98c5 and at upstream GitHub issue 67 on the OmniAgent repository. Reaching the flaw needs something able to steer the agent, which VulnCheck describes as prompt injection.

Sources 2 links, all fetched

1vulncheck.comVulnCheck Advisory
2github.comGitHub Advisory