# CVE-2026-62675: Omnigent authenticated remote code execution via Python callable tools

Source: https://junglewise.ai/threats/cve-2026-62675-omnigent-authenticated-remote-code-execution-via-python-callable  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62675 · Severity: high · CVSS 8.8 · Published 2026-08-21

Omnigent is an AI agent framework that allows users to upload custom agent configurations. An authenticated user can upload a malicious configuration that invokes dangerous Python functions (like subprocess.check_output) on the server's runner environment, leading to arbitrary command execution. In hosted multi-user deployments, this allows a normal user to execute code with runner privileges, potentially exposing credentials, workspace data, and internal services.

Technologies: [omnigent (PyPI)](https://junglewise.ai/threats/technologies/omnigent). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-62675 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62675 being exploited in the wild.

**How severe is CVE-2026-62675?** High severity, with a CVSS score of 8.8, published 21 August 2026.

**Which products and versions are affected?** omnigent (PyPI) < 0.3.0, ECOSYSTEM:introduced=0,fixed=0.3.0.

**Is there a fix for CVE-2026-62675?** Yes. omnigent (PyPI): upgrade to 0.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62675 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-62675?** Check whether you run omnigent (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- omnigent (PyPI): upgrade to 0.3.0 or later

  ```sh
  pip install "omnigent>=0.3.0"
  ```


## Technical details

This is a code injection vulnerability (CWE-94) in Omnigent's agent bundle validation. The vulnerability occurs in the trust boundary between uploaded user bundles and trusted operator features. The server's validate_agent_bundle() function disables environment expansion and can enforce policy-handler allowlists, but it does not reject tools.<name>.callable entries. Later, _resolve_spec_callable() uses importlib.import_module() to dynamically import and execute the callable at the dotted path specified by the user, such as subprocess.check_output. An authenticated user can exploit this by uploading a crafted bundle via POST /v1/sessions with a tool callable pointing to any importable Python function. No user interaction or special privileges are required beyond initial authentication. The fix was to reject callable: tool paths for tenant-uploaded bundles unless explicitly allowlisted by the operator.

## Affected products

- omnigent-ai omnigent < 0.3.0

## Identifiers

- CVE-2026-62675
- GHSA-756x-9hf6-q4h4
- PYSEC-2026-3872

## Timeline

- 2026-06-29: disclosed
- 2026-09-02: patched: Version 0.3.0 released with fix
- 2026-09-02: advisory

## References

- [https://api.github.com/users/xttraa](https://api.github.com/users/xttraa)
- [https://github.com/xttraa](https://github.com/xttraa)
- [https://api.github.com/users/xttraa/gists%7B/gist_id%7D](https://api.github.com/users/xttraa/gists%7B/gist_id%7D)
- [https://api.github.com/users/xttraa/repos](https://api.github.com/users/xttraa/repos)
- [https://avatars.githubusercontent.com/u/191876097?v=4](https://avatars.githubusercontent.com/u/191876097?v=4)
- [https://api.github.com/users/xttraa/events%7B/privacy%7D](https://api.github.com/users/xttraa/events%7B/privacy%7D)

## Related threats

- [Omnigent path traversal in agent bundle os_env.cwd](https://junglewise.ai/threats/cve-2026-62677-omnigent-path-traversal-in-agent-bundle-os-env-cwd)
- [Omnigent shell-command parser policy bypass in _shell.py](https://junglewise.ai/threats/cve-2026-62676-omnigent-shell-command-parser-policy-bypass-in-shell-py)
- [Omnigent shared agent bundle overwrite leading to authenticated RCE](https://junglewise.ai/threats/cve-2026-62674-omnigent-shared-agent-bundle-overwrite-leading-to-authenticated)