OmniRoute ACP custom-agent registration is remote code execution, unauthenticated whenever requireLogin is off

GitHub Security Advisories·medium signalXBlueskyLinkedInCopy link

CVE-2026-88062 (GHSA-hf57-cqmx-p4gr, critical) covers POST /api/acp/agents in OmniRoute, which accepts attacker-supplied `binary` and `versionCommand` and then runs execFileSync during agent version detection. The only check is that the first token of versionCommand matches `binary`, which the attacker also controls, so `{"binary":"node","versionCommand":"node -e ..."}` executes arbitrary Node inside the container. With requireLogin=false, or during the bootstrap window before a management password exists, /api/acp/ is not covered by the LOCAL_ONLY or spawn-capable prefixes, so a single anonymous HTTP request is enough.