OmniAgent: ReflexionAgent command injection via find (CVE-2026-125368)

OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in the ReflexionAgent._is_safe_bash_command function. The component incorrectly validates shell commands by only checking if they start with the 'find' utility, failing to inspect the arguments passed to the '-execdir' flag. This allows an attacker to bypass human-in-the-loop security controls.

Impact

An attacker can leverage prompt injection to force the agent to execute unauthorized binaries such as 'dd', 'nc', 'perl', or 'openssl' within an unsandboxed shell environment. This results in the potential for arbitrary code execution or unauthorized file modification on the host running the agent.

Recommendation

• Inventory all instances of OmniAgent running versions up to commit 12b98c5.
• Audit application logs for calls to 'find' that include the '-execdir' argument within agent-managed shell execution environments.
• Implement input validation or restrict binary execution at the OS level for environments hosting OmniAgent to prevent the execution of sensitive binaries like 'nc' or 'dd' by the agent process.