CVE-2026-88062: 
JavaScript vulnerability analysis and mitigation

CVE-2026-88062 is a Critical remote code execution (RCE) vulnerability in OmniRoute, an open-source AI gateway (npm package omniroute). The flaw exists in the POST /api/acp/agents endpoint, which accepts attacker-controlled binary and versionCommand values and passes them to execFileSync after only a self-consistency check, enabling arbitrary code execution inside the server container. Affected versions are all releases up to and including 3.8.50 (the advisory initially listed < 3.8.49 as affected; the GitHub Advisory Database updated this to <= 3.8.50 with no patched version listed at time of publication). The vulnerability was reported by researcher c111mb3r, published to the GitHub Advisory Database on September 10, 2026, and carries a CVSS v4.0 base score of 9.5 (Critical) (Github Advisory, OmniRoute Advisory).

The root cause is a combination of CWE-94 (Improper Control of Code Generation / Code Injection) and CWE-306 (Missing Authentication for Critical Function). The POST /api/acp/agents handler stores attacker-supplied binary and versionCommand fields without an executable allowlist, then immediately calls refreshAgentCache(), which invokes detectInstalledAgents() → detectAgent() → execFileSync(probe.command, probe.args, ...). The sole validation, resolveVersionProbe(), only checks that the first token of versionCommand matches binary — but since binary is also attacker-controlled, submitting binary: "node" and versionCommand: "node -e \"...arbitrary JS...\"" trivially passes. The DISALLOWED_VERSION_COMMAND_CHARS filter blocks only a narrow set of shell metacharacters (;&|<>\$\r\n) and does not block interpreter evaluation flags like -eor-c. On Linux, shouldUseShellForVersionProbe()returnsfalse, so the effective call is execFileSync("node", ["-e", "..."])— no shell metacharacters are needed. The authentication bypass arises becauseisAuthenticated()delegates toisAuthRequired(), which returns falsewhenrequireLogin=false, and /api/acp/is absent from bothLOCAL_ONLY_API_PREFIXESandSPAWN_CAPABLE_PREFIXES`, allowing the endpoint to reach the anonymous-allow branch (Github Advisory, OmniRoute Advisory).

Successful exploitation grants an attacker arbitrary code execution inside the OmniRoute server container, with full confidentiality, integrity, and availability impact on both the vulnerable system and any subsequent systems it can reach. An unauthenticated remote attacker can read or exfiltrate sensitive data stored in the container (API keys, provider credentials, OAuth tokens), modify or destroy application data, and pivot to other services accessible from the container network. When requireLogin=false or during the bootstrap window of a fresh instance, exploitation requires no credentials whatsoever; when requireLogin=true, exploitation is limited to authenticated management-session holders but still results in full container compromise (Github Advisory, OmniRoute Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation as of the time of this report. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the advisory includes detailed reproduction steps using a single curl command, making weaponization straightforward for any attacker who reads the advisory. The attack requires no authentication when requireLogin=false (a common self-hosted configuration) and no shell metacharacters, lowering the exploitation barrier significantly (Github Advisory, Feedly).

1. Reconnaissance: Identify internet-facing OmniRoute instances (npm package omniroute, default port 20128) using Shodan, Censys, or similar tools. Check /api/health for a live response to confirm the service is running.
2. Check authentication state: Send a probe request to POST /api/settings/require-login or attempt an unauthenticated request to /api/acp/agents. If requireLogin=false, proceed directly to step 4.
3. Bootstrap window abuse (if fresh instance): If the instance has no management password set yet, send POST /api/settings/require-login with body {"requireLogin":false} to disable authentication before the administrator completes setup.
4. Craft the RCE payload: Construct a JSON body with binary set to a Node.js interpreter (node) and versionCommand set to node -e "<arbitrary JS>". The JS payload can use require('child_process').execSync(...) to run OS commands:

{
  "id": "anonrce",
  "name": "anonrce",
  "binary": "node",
  "protocol": "stdio",
  "versionCommand": "node -e \"require('child_process').execSync('id > /app/data/pwned.txt')\""
}

5. Send the exploit request: Submit the payload as an unauthenticated HTTP POST to http://<target>:20128/api/acp/agents with Content-Type: application/json. The handler saves the agent and immediately calls refreshAgentCache(), which triggers execFileSync('node', ['-e', '...']) synchronously within the same request.
6. Verify execution: Confirm code execution by reading the output file (e.g., docker exec <container> cat /app/data/pwned.txt) or by establishing a reverse shell via the injected Node.js payload (Github Advisory, OmniRoute Advisory).

• Network: Unexpected HTTP POST requests to /api/acp/agents from external or untrusted IP addresses, especially with no Authorization or Cookie headers; outbound connections from the OmniRoute container to unknown external hosts following such requests.
• Logs: OmniRoute access logs showing POST /api/acp/agents requests with JSON bodies containing versionCommand values including -e, -c, --eval, or other interpreter evaluation flags; HTTP 200 responses to such requests from unauthenticated sources.
• File System: Unexpected files written to /app/data/ or other container-writable directories (e.g., UNAUTH_RCE_PROOF.txt, web shells, or exfiltration staging files); new or modified files in the OmniRoute installation directory.
• Process: Unusual child processes spawned by the Node.js OmniRoute process, such as sh, bash, curl, wget, python, or nc; short-lived processes consistent with execSync calls (e.g., id, uname, whoami).
• Application State: Presence of unexpected custom ACP agent entries (with binary: "node" or binary: "python3" and eval-style versionCommand) in the OmniRoute settings/database (Github Advisory, OmniRoute Advisory).

The fix was merged in pull request #11028 targeting the release/v3.8.50 branch (commit 6082924), which restricts resolveVersionProbe() for untrusted (client-registered) custom agents to accept only a bare binary or a single recognized version flag (-v, -V, --version, -version, version, --ver), blocking all interpreter evaluation arguments. Operators should upgrade to a version containing this fix as soon as it is released. As an immediate workaround: (1) ensure requireLogin=true and configure a strong management password to eliminate the unauthenticated attack surface; (2) implement network-level access controls (firewall rules, reverse proxy restrictions) to block external access to /api/acp/ endpoints; (3) monitor for suspicious POST requests to /api/acp/agents containing evaluation-style arguments in versionCommand (OmniRoute PR, Github Advisory).

The vulnerability was discussed on Mastodon (mastodon.social/@stemshop and infosec.exchange/@DailyCyberSecurity) shortly after disclosure. SecurityOnline.info published a write-up referencing the PoC reproduction steps. Tenable added a cloud security plugin (ID 447918) for detection. The OmniRoute maintainer (diegosouzapw) responded promptly with a fix merged on August 21, 2026, crediting the reporter c111mb3r in the commit body and addressing the issue as part of a broader security advisory triage pass covering multiple findings (Github Advisory, OmniRoute PR).