GHSA-756x-9hf6-q4h4 is a high-severity (CVSS 8.8) Code Injection vulnerability in omnigent. O3 Security confirms whether GHSA-756x-9hf6-q4h4 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for GHSA-756x-9hf6-q4h4.
Real-World Exposure
omnigentReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.
When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.
This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.
Details
The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:
Create custom agent builds and uploads a bundle
createBundledSession posts the bundle to /v1/sessions
A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.
On the server, uploaded bundles are validated here:
validate_agent_bundle
The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:
spec = load(
bundle_bytes,
dest=Path(tmpdir) / "agent",
expand_env=False,
enforce_handler_allowlist=enforce_handler_allowlist,
)
However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.
The docs describe server-side Python callable tools here: Python function tool docs
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path
mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)
_execute_spec_callable_tool calls the resolved function
result = await asyncio.to_thread(resolved, **args)
The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback
output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)
The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.
Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.
Impact
This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.
Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.
This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | omnigent | all versions | 0.3.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for omnigent. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update omnigent to 0.3.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-756x-9hf6-q4h4 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-756x-9hf6-q4h4 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-756x-9hf6-q4h4. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-756x-9hf6-q4h4 in your dependencies?
O3 detects GHSA-756x-9hf6-q4h4 across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.