CVE-2026-88062: 
JavaScript vulnerability analysis and mitigation

CVE-2026-88062 is a Critical remote code execution (RCE) vulnerability in OmniRoute, an open-source AI gateway (npm package omniroute). The flaw exists in the POST /api/acp/agents endpoint, which accepts attacker-controlled binary and versionCommand values and passes them to execFileSync after only a self-consistency check, enabling arbitrary code execution inside the server container. It affects all versions up to and including 3.8.50 (the advisory initially stated ≤ 3.8.49; the GitHub Advisory Database lists ≤ 3.8.50 as affected). The vulnerability was reported by researcher c111mb3r, published to the GitHub Advisory Database on September 10, 2026, and carries a CVSS v4.0 base score of 9.5 (Critical) (Github Advisory, OmniRoute Advisory).

The root cause is a combination of CWE-94 (Improper Control of Code Generation / Code Injection) and CWE-306 (Missing Authentication for Critical Function) (Github Advisory). The POST /api/acp/agents handler accepts user-supplied binary and versionCommand fields and stores them without an executable allowlist. The sole validation — resolveVersionProbe() — only checks that the first token of versionCommand matches binary; because binary is also attacker-controlled, submitting binary: "node" and versionCommand: "node -e \"...arbitrary JS...\"" passes the check. After saving the agent, refreshAgentCache() is called immediately, which invokes execFileSync(probe.command, probe.args, ...) — executing the injected Node.js code without any shell metacharacters required. The DISALLOWED_VERSION_COMMAND_CHARS filter blocks only ; & | < > \ $ \r \n, leaving evaluation arguments like -eand-cfully permitted. Compounding this,isAuthenticated()returnstruefor anonymous requests whenrequireLogin=false, and /api/acp/is absent from bothLOCAL_ONLY_API_PREFIXESandSPAWN_CAPABLE_PREFIXES`, so the endpoint is never blocked by the local-only gate (OmniRoute Advisory).

Successful exploitation grants an attacker arbitrary code execution inside the OmniRoute server container as the Node.js process user, with full access to the container's filesystem, environment variables, and network. This enables exfiltration of sensitive data stored by OmniRoute — including API keys, provider credentials, OAuth tokens, and the SQLite database — as well as installation of backdoors, lateral movement to adjacent container services, or complete denial of service. The CVSS v4.0 score reflects high impact on both the vulnerable system and subsequent systems (confidentiality, integrity, and availability all rated High) (Github Advisory).

A detailed proof-of-concept (PoC) with reproduction steps is included in the public GitHub Security Advisory, making exploitation straightforward with a single curl command (OmniRoute Advisory). A Nuclei template for this CVE was released in projectdiscovery/nuclei-templates v10.4.9, enabling automated scanning. The EPSS score is approximately 0.94–1.42% (72nd percentile), indicating moderate exploitation probability. No in-the-wild exploitation or threat actor attribution has been reported as of the advisory date, and the CVE is not listed in the CISA KEV catalog. The vulnerability is most severe when requireLogin=false (unauthenticated RCE); with requireLogin=true, exploitation requires a valid management session or management-scoped API key (Github Advisory).

1. Reconnaissance: Identify internet-facing OmniRoute instances (npm package omniroute, default port 20128) using Shodan, Censys, or similar tools. Check /api/health for a live response.
2. Check authentication state: Probe whether requireLogin is disabled by attempting an unauthenticated request to a protected endpoint. If the instance is freshly deployed with no management password, proceed to step 3a; otherwise skip to step 3b. 3a. Bootstrap window attack (fresh instance): Send an unauthenticated POST to /api/settings/require-login with body {"requireLogin":false} to disable authentication before a password is set. 3b. Authenticated path: If requireLogin=true and a password is set, obtain a management session cookie or management-scoped API key through credential theft or brute force.
3. Craft the RCE payload: Construct a JSON body where binary and the first token of versionCommand match (e.g., both "node"), and versionCommand contains a Node.js -e eval argument with the desired payload:

{
  "id": "anonrce",
  "name": "anonrce",
  "binary": "node",
  "protocol": "stdio",
  "versionCommand": "node -e \"require('child_process').execSync('id > /app/data/pwned.txt')\""
}

5. Trigger execution: Send the payload via POST /api/acp/agents. The handler saves the agent and immediately calls refreshAgentCache(), which invokes execFileSync('node', ['-e', '...']) — executing the injected code synchronously.
6. Achieve objective: The injected Node.js code runs as the container's process user, enabling file writes, reverse shells, credential exfiltration, or further lateral movement (OmniRoute Advisory).

• Network: Unexpected HTTP POST requests to /api/acp/agents from external/untrusted IP addresses, especially with no Authorization header or session cookie; outbound connections from the OmniRoute container to unknown external hosts following such requests.
• Logs: Application logs showing a new custom agent registration (anonrce or similarly suspicious id) immediately followed by refreshAgentCache execution; HTTP 200 responses to POST /api/acp/agents from anonymous sources.
• File System: Unexpected files written to /app/data/ (e.g., UNAUTH_RCE_PROOF.txt, pwned.txt, or web shells); new or modified files in the OmniRoute installation directory created by the Node.js process user.
• Process: Unusual child processes spawned by the Node.js OmniRoute process, such as sh, bash, curl, wget, python, or ruby; execSync calls to system commands like id, uname, whoami, or network utilities.
• Database/Config: Unexpected entries in the customAgents settings table with binary values like node, python3, ruby, or other interpreters and versionCommand values containing -e, -c, or --eval arguments (OmniRoute Advisory).

The fix was merged in pull request #11028 and released in OmniRoute version 3.8.50 (commit 6082924): resolveVersionProbe() now restricts untrusted (client-registered) custom agent probes to a bare binary or a single recognized version flag (-v, -V, --version, -version, version, --ver), blocking all eval-style arguments (OmniRoute PR #11028). Upgrade to version 3.8.50 or later immediately. If upgrading is not immediately possible, apply the following mitigations:

• Enable requireLogin=true and configure a strong management password to prevent unauthenticated access to the endpoint.
• Restrict network access to the OmniRoute management port (default 20128) using firewall rules or network policies so only trusted hosts can reach /api/acp/ endpoints.
• Monitor for suspicious POST /api/acp/agents requests containing interpreter names (node, python3, ruby) with evaluation arguments in versionCommand.

The vulnerability was noted by the DailyCyberSecurity account on Mastodon (infosec.exchange/@DailyCyberSecurity) shortly after disclosure. SecurityOnline.info published a write-up referencing the PoC (securityonline.info/omniroute-rce-flaw-cve-2026-88062-poc). The OmniRoute maintainer (diegosouzapw) responded promptly, merging a fix within the same release cycle (v3.8.50) and crediting the reporter c111mb3r in the commit message (OmniRoute PR #11028). Automated scanning coverage was added via a Nuclei template in projectdiscovery/nuclei-templates v10.4.9, indicating community interest in detection.