What happened
A path-traversal flaw (CWE-22, CVSS 7.5 v3.1 / 7.7 v4.0) lets an authenticated user escape the Omnigent agent workspace by controlling the sub-agent's cwd through os_env. The root-only workspace-escape check in bundles.py is not applied to nested sub-agent cwd values, so an attacker can move the agent's read/write operations onto host files outside the intended directory.
Why it matters
Omnigent is an agent-orchestration platform where bundles run with the runner user's authority; this sandbox escape turns a low-privileged authenticated user into code execution (read/write) on the host, defeating the isolation that keeps untrusted agent bundles contained.
Attack vector
Authenticated user uploads a bundle whose nested sub-agent sets os_env.cwd to an absolute or parent-traversing path, bypassing the root-only validation in omnigent/server/bundles.py; the agent then reads/writes host files outside the intended workspace as the runner user.
Affected systems
omnigent (PyPI) 0.3.0 through <0.14.0
Mitigation
Upgrade to 0.14.0 (fix commit 4a406d5b3b3f3a7c3401eab659ab04e728923b94); advisory GHSA-p5x3-3gqh-x44g.