CVE-2026-62675

### Summary An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous `callable:` paths in untrusted user-provided agent configs. When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at `subprocess.check_output`, which lets the attacker run a local command on the runner machine. This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands. ### Details The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart `POST /v1/sessions`; the Web UI uses this same endpoint for custom agents: [`Create custom agent` builds and uploads a bundle](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/ap-web/src/shell/NewChatDialog.tsx#L1265-L1277) \ [`createBundledSession` posts the bundle to `/v1/sessions`](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/ap-web/src/lib/sessionsApi.ts#L421-L460) A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce. On the server, uploaded bundles are validated here: [`validate_agent_bundle`](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/omnigent/server/bundles.py#L13-L75) The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist: ```python spec = load( bundle_bytes, dest=Path(tmpdir) / "agent", expand_env=False, enforce_handler_allowlist=enforce_handler_allowlist