OmniRoute ACP Custom-Agent Endpoint Allows Remote Code Execution (CVE-2026-88062)

What Happened

In OmniRoute version 3.8.49 and earlier (and confirmed affected through 3.8.50), the POST /api/acp/agents endpoint accepts attacker-controlled 'binary' and 'versionCommand' values for custom ACP agents. These values pass through a 'self-consistency' check and the tokenizeVersionCommand function with its DISALLOWED_VERSION_COMMAND_CHARS filter before being executed via execFileSync. The filter blocks a limited set of shell metacharacters but does not block interpreter evaluation arguments, meaning a crafted versionCommand can still cause arbitrary code execution when the interpreter processes it.

Technical Cause

The same request that creates a custom agent also triggers refreshAgentCache, and the resolveVersionProbe function accepts the matched command before it reaches the execFileSync sink. The input filtering in tokenizeVersionCommand and DISALLOWED_VERSION_COMMAND_CHARS is incomplete: it rejects certain shell metacharacters but permits interpreter evaluation arguments, which an attacker can use to smuggle executable code into the command that execFileSync runs. This is classified as CWE-94, Improper Control of Generation of Code ('Code Injection').

Who Is Affected

Authentication requirements depend on configuration. The isAuthenticated function relies on isAuthRequired, which permits anonymous requests when requireLogin is set to false. Additionally, the 'api/acp/' path is absent from both LOCAL_ONLY_API_PREFIXES and SPAWN_CAPABLE_PREFIXES, meaning it is not restricted the way other sensitive endpoints are. As a result: with requireLogin=false, or during a fresh-instance bootstrap window, a remote anonymous attacker can exploit this issue. With requireLogin=true and a configured management password, exploitation instead requires a management session or a management-scoped API key.

Affected Versions

OmniRoute versions from 0 through 3.8.50 are affected, which includes 3.8.49 and earlier as stated in the advisory description. No fixed version has been published at the time of this review.

Fixes and Mitigation

No fixed version is currently available for this vulnerability. Site owners should treat this as an open issue and monitor the GitHub Security Advisory (GHSA-hf57-cqmx-p4gr) for updates on a patched release.

Recommended Action

Until a fix is released, operators running OmniRoute should ensure requireLogin is enabled and a management password is configured, since this raises the bar for exploitation from anonymous remote access to requiring a management session or management-scoped API key. Operators should also be aware of the fresh-instance bootstrap window, during which anonymous exploitation may still be possible even with requireLogin intended to be enabled, and should restrict network access to the /api/acp/agents endpoint where possible until a patch is available.