GitHub discloses command-approval bypass in the OmniAgent AI agent framework

A GitHub Security Advisory published on November 10, 2026, details a high-severity flaw that lets prompt-injected agents bypass human approval and run arbitrary commands in OmniAgent.

GitHub Security Advisories published a security advisory on November 10, 2026, describing a high-severity command-approval bypass in OmniAgent, an AI agent framework maintained by YeQing17-2026/OmniAgent. The flaw lets prompt-injected agents skip human approval and execute arbitrary binaries through a crafted find command using the -execdir flag. Details are in the OmniAgent ReflexionAgent command approval bypass via find -execdir advisory.

What the advisory discloses

GHSA ID GHSA-3ph8-93x7-786r, tracked as CVE-2026-125368.
Severity rated High, with a CVSS score of 7.7.
Affects OmniAgent through commit 12b98c5.
The flaw sits in ReflexionAgent._is_safe_bash_command, which treats any command starting with find as safe without inspecting its -execdir arguments.
Prompt-injected agents can use find ... -execdir to invoke binaries such as dd, nc, perl, or openssl through an unsandboxed shell.
The result is unauthorized file overwrite or code execution without human approval, classified under CWE-184 (Incomplete List of Disallowed Inputs).

What it means for AI builders

The case is a concrete example of an allowlist-based command-approval guardrail being defeated by prompt injection, a pattern relevant to anyone building or trusting automated approval gates for agent tool calls. Checking only the first word of a command, such as find, while leaving its arguments uninspected gives an attacker room to smuggle execution through flags like -execdir.

Sources

OmniAgent ReflexionAgent command approval bypass via find -execdir (GitHub Security Advisories, November 10, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.