Executive brief
OmniRoute is a server application that allows administrators to configure custom agent binaries for execution. A vulnerability in the `/api/acp/agents` endpoint allows unauthenticated attackers to register malicious agents with arbitrary command arguments when authentication is disabled. When the agent is registered, the server immediately attempts to detect the agent's version by executing the attacker-supplied command, leading to arbitrary code execution inside the OmniRoute container.
Technical details
The vulnerability is a command injection flaw in the custom agent registration endpoint at `POST /api/acp/agents`. The endpoint accepts `binary` and `versionCommand` parameters without an allowlist and immediately executes them via `execFileSync(probe.command, probe.args)` during `refreshAgentCache()`. The only validation is `resolveVersionProbe()`, which checks that the first token of `versionCommand` matches the attacker-supplied `binary`; since both are attacker-controlled, this is a self-consistency check that can be bypassed trivially (e.g., `binary="node"` and `versionCommand="node -e \"require('child_process').execSync('malicious command')\""` passes validation). When `requireLogin=false`, the endpoint skips authentication entirely because `isAuthenticated()` returns `true` for all requests. The `/api/acp/` path is also not included in `LOCAL_ONLY_API_PREFIXES`, so it reaches the anonymous allow branch. No patched version is currently available.
Affected products
- diegosouzapw OmniRoute <= 3.8.50
Timeline
- 2026-09-10: disclosed
- 2026-09-03: advisory