What happened
CWE-184 approval bypass in OmniAgent. The command-approval gate meant to stop an agent from running destructive shell commands is trivially bypassed by any command starting with 'find' because the validator never inspects sub-arguments. VulnCheck published the advisory (CVSS 7.5).
Why it matters
This defeats the human-approval safety boundary that is the last line of defense for a prompt-injected agent. A malicious prompt can drive the agent to run arbitrary binaries on the host without the operator ever seeing a consent prompt — a path from prompt injection to host RCE.
Attack vector
ReflexionAgent._is_safe_bash_command treats any command starting with 'find' as safe without inspecting -execdir arguments. A prompt-injected agent runs 'find' with -execdir to invoke binaries such as dd, nc, perl or openssl through an unsandboxed shell, overwriting files or executing code without human approval.
Affected systems
YeQing17-2026/OmniAgent up to commit 12b98c520959eff88a6cfa3dd233497084360ab0
Mitigation
No upstream fix yet; update/upgrade the OmniAgent dependency or restrict/deny 'find' in the safe-command allowlist and inspect -execdir/exec. Track issue #67.