Omnigent's Nested Path Closed in September. The CVE Is Today.

GHSA-p5x3-3gqh-x44g is the primary. GitHub published it at 11:17:43 UTC on 16 September 2026 and marked it high. An authenticated user could upload an agent bundle whose nested sub-agent set a working directory the root-agent check would have rejected. The same value, refused on the root, was accepted one level down. The advisory's patched version is Omnigent 0.14.0.

CVE-2026-112015 is VulnCheck's number for that advisory, published at 11:38:36 UTC on 18 October 2026 and updated at 12:23:31 UTC the same morning. A read of the GitHub advisory API on 18 October still showed no CVE id on the advisory. The package clock and the number clock are a month apart. PyPI lists the author as Databricks, Inc. The repository describes Omnigent as a meta-harness for Claude Code, Codex, Cursor, Pi, and custom agents.

US X trends at 22:28 UTC on 18 October were NFL names. This CVE was not one of them.

High High follows the GitHub advisory. The two published scores do not match, and the gap is the complexity field, not a second bug.

The package clock is 0.14.0.#

Pull request 7457 merged at 08:24:06 UTC on 15 September. The merge commit is 4a406d5b, which the CVE cites. PyPI omnigent 0.14.0 uploaded at 13:00:15 UTC that day. The GitHub release v0.14.0 published at 13:06:10 UTC, six minutes later. Tag v0.14.0rc1 already contains that commit. PyPI uploaded 0.14.0rc1 at 11:10:22 UTC on 15 September. The CVE's semver range, 0.3.0 before 0.14.0, includes that release candidate. The candidate is not an unpatched build.

Tag v0.13.0 does not contain the commit. PyPI 0.13.0 uploaded at 14:29:07 UTC on 9 September, and the GitHub release published at 14:56:32 UTC the same day. The advisory's vulnerable range is <= 0.13.0, patched at 0.14.0. The CVE starts the range at 0.3.0. Keep both sentences. Do not collapse them into "everything before 0.14.0" without the parent bug underneath.

PyPI latest on 18 October is 0.18.0, uploaded at 08:32:17 UTC on 13 October. The GitHub release v0.18.0 published at 08:34:10 UTC the same morning. This brief did not diff 0.18.0. The advisory says 0.14.0 or later.

The score split is complexity.#

GitHub's CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8. VulnCheck's CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.5. VulnCheck's CVSS 4.0 vector marks attack requirements present and scores 7.7. The advisory lists CWE-22 and CWE-668. The CVE lists CWE-22.

The prerequisites in the advisory are the requirements the 4.0 vector is pointing at. The server accepts untrusted bundles. The runner does not have OMNIGENT_RUNNER_WORKSPACE set. The reported configuration sets sandbox.type to none. The caller is authenticated. Trusted single-user local operation, where the operator already controls the executed code, is outside the report's threat model. This brief does not rescore the bug. It reports both vectors so a ticket does not quote 8.8 and 7.5 as if they were two findings.

The advisory credits @carfeii. A duplicate, GHSA-f2xx-j6gv-ffc8, submitted 14 September, was closed as the same defect, and the advisory also credits zx (@manus-pi). A terminal-path report, GHSA-598r-29w2-g93q, is a different precondition and is not this CVE.

1. 2026-06-29
   GHSA-p8rw-8qj3-hf33 publishes for the root-agent check. Patched version 0.3.0. PyPI 0.3.0 had uploaded on 27 June.
2. 2026-09-09
   The sub-agent report is submitted. No minute is in the advisory. PyPI 0.13.0 uploads at 14:29 UTC. The GitHub release publishes at 14:56 UTC.
3. 2026-09-15
   08:24 UTC, pull request 7457 merges. 11:10 UTC, 0.14.0rc1 is on PyPI and already contains the commit. 13:00 UTC, PyPI 0.14.0. 13:06 UTC, GitHub v0.14.0.
4. 2026-09-16
   11:17 UTC, GHSA-p5x3-3gqh-x44g publishes. Twenty-two hours and eleven minutes after the GitHub release.
5. 2026-10-18
   11:38 UTC, CVE-2026-112015 publishes. Thirty-two days and twenty minutes after the advisory. The GitHub advisory API still has no CVE id.

0.3.0 closed a different check.#

GHSA-p8rw-8qj3-hf33, CVE-2026-62677, covers versions before 0.3.0 and was published at 14:52 UTC on 29 June. Its patched version is 0.3.0. The September advisory says that root-agent check must not be interpreted as the nested path. A fleet pinned at 0.3.0 through 0.13.0 can be "patched" on the June CVE and still inside this one.

The impact clock is a run that already happened. The advisory says the 0.14.0 change enforces the upload boundary. It does not change how a terminal chooses its directory at runtime, and it does not turn a trusted local config into an untrusted upload. Installing 0.14.0 does not rewind files a previous bundle already read or wrote as the runner user.

What to do on a shared runner.#

1. If the server accepts bundles you do not trust, move to 0.14.0 or later. Current PyPI latest is 0.18.0. Set OMNIGENT_RUNNER_WORKSPACE on runners. The reported case had the OS sandbox off. Turn that sandbox back on unless you have a written reason not to.
2. Do not close the ticket with "we are on 0.3.0." That version is the parent fix. The nested range runs through 0.13.0.
3. Treat a release candidate carefully. v0.14.0rc1 contains the fix commit, even though a semver "before 0.14.0" rule would still flag it. v0.13.0 does not contain the commit.
4. Review runners that executed uploaded bundles before 15 September. The upgrade does not undo that work. The advisory's threat model is the shared server, not a laptop where the operator already controls the code.
5. Quote one score and name the source. GitHub's 8.8 and VulnCheck's 7.5 are the same advisory with a different complexity bit. They are not two CVEs.