AI agents

CVE-2026-84779 is a Subscriber Broken Access Control flaw in Agentimus – AI SEO, llms.txt & MCP for AI Agents, affecting versions up to and including 1.51.0. The source text provides no further detail on how the flaw is reached or what an attacker gains.

Omnigent, an open-source AI agent framework and meta-harness for orchestrating coding agents, is affected by CVE-2026-62677 in versions prior to 0.3.0. An authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value, which the parser and validator store without constraint. When OMNIGENT_RUNNER_WORKSPACE is unset, the attacker-controlled path becomes the trusted root, letting sys_os_read, write, edit and shell tools reach runner files and environment secrets outside the intended workspace.

Omnigent, an open-source AI agent framework and meta-harness for orchestrating coding agents, has a flaw in its shared shell-command parser (omnigent/policies/builtins/_shell.py) before version 0.3.0. The parser does not recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, or a single background control operator. A gated git push or gh write hidden in these forms yields no parsed operation, so the github.py write_repos and write_branches allowlist and the working_dir.py workspace confinement policies abstain and allow the command. An authenticated or prompt-injected agent can therefore push to an unauthorized repository or branch or escape the intended workspace (CVE-2026-62676).

CVE-2026-62675 affects Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0. An authenticated user can submit an agent bundle to POST /v1/sessions, and validate_agent_bundle in omnigent/server/bundles.py fails to reject a tools..callable dotted Python path, so the bundle can select subprocess.check_output and run a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access.

The Apify MCP server, prior to version 0.10.11, builds the Actor MCP server URL in getActorMCPServerURL (src/mcp/actors.ts) by concatenating the trusted Actor standby URL with the attacker-controlled webServerMcpPath from an Actor definition, without checking the resulting origin. A malicious Actor publisher can use a userinfo-style authority value to redirect connectMCPClient to a third-party host. The call-actor, fetch-actor-details, and actor-mcp paths then send the victim's Authorization bearer token, exposing the Apify API token and granting access to Actors, stored data, and billable compute. Exploitation requires that a victim invoke or inspect the attacker-controlled Actor.

Trigger.dev versions from 4.4.2 through 4.5.0-rc.5 let a caller with a valid environment API key obtain presigned URLs for another tenant's object-store keys. The flaw arises because user-controlled packet keys are assigned to URL.pathname without rejecting dot segments, and the packets route performs no per-resource ownership validation. WHATWG path normalization collapses .. segments before signing, so an attacker can read or overwrite another tenant's task payloads.

Trigger.dev versions prior to 4.5.2 contain an account takeover flaw in the Google sign-in flow. The function addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() without checking Google's email_verified assertion. An attacker can use a Google profile with an unverified matching email to attach their Google authIdentifier to an existing email-matched account and log in as that user.

CVE-2026-73654 affects Trigger.dev from 3.3.8 until 4.5.6. The PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.key).set() in packages/core/src/v3/runMetadata/operations.ts without rejecting constructor and prototype path segments. A caller with a normal environment API key can pollute Object.prototype in the shared webapp process, corrupting Prisma queries and Prometheus labels, breaking other tenants' worker authentication, and causing a process-wide denial of service.

goose versions before 1.44.0 run the system git executable in the `goose review` command to gather diffs without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets core fsmonitor to a command causes Git to execute that command on the host during `git diff HEAD`, before any model call or trust prompt, with the privileges of the user running goose. The affected invocations are built by git_command() in crates/goose-cli/src/commands/review/handler.rs.

CVE-2026-9196 affects IBM Langflow OSS 1.0.0 through 1.10.3. An authenticated attacker can execute unintended code during Agentic Assistant validation, because the application runs model-generated Python code in the backend before user approval. The source says this may allow side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process. The weakness is classified as CWE-94, Improper Control of Generation of Code ('Code Injection').

Versions of Ouroboros, a local-first runtime for AI coding agents, prior to 0.42.1 ship an incomplete denylist of untrusted .env keys. A malicious cloned repository can include a .env file that is auto-loaded at import with no review step, letting an attacker reach arbitrary command execution. The earlier CVE-2026-47211 fix added _UNTRUSTED_ENV_DENYLIST for project-directory .env files but missed several keys. Other variables let attackers redirect the backend config-home and MCP/plugin roots past the approval gate, re-enable blocked local transports, replace sub-agent prompts, and lower tool approval classes.