OmniRoute npm Package RCE Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- omniroute (npm)
- Affected versions
- <= 3.8.50
- Patched version
- Not yet available
An early warning has been issued for a remote code execution vulnerability in the OmniRoute npm package affecting versions <= 3.8.50.
What happened
The OmniRoute npm package reportedly contains a remote code execution vulnerability in its custom ACP agent registration endpoint. An attacker can submit malicious code that executes arbitrary Node.js code inside the server container. This vulnerability is under investigation and has not been exploited in the wild as of the latest reports. The affected versions are <= 3.8.50. The issue was first flagged on September 10, 2026.
To assess your exposure, check if your application uses the OmniRoute npm package and verify the version in use. If you are using a version <= 3.8.50, you are potentially affected. It is recommended to upgrade to the latest version as soon as it becomes available and to configure requireLogin to true in production environments.
What to do about it
- Check the version of OmniRoute npm package your application is using.
- If your application uses a version <= 3.8.50, upgrade to the latest version once it is released.
- Set requireLogin to true in your production environment configurations.
- Monitor the official sources for updates on the vulnerability and any released patches.
- No official fix has been published yet. Continue to monitor the sources below for updates.
How 0Day would have caught this
omniroute is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If your application uses the OmniRoute npm package version <= 3.8.50, you are potentially affected.
What should I do right now?
Check your OmniRoute npm package version. If it is <= 3.8.50, prepare to upgrade to the latest version once it is released and set requireLogin to true in production.
Is there a patched version available?
No official patched version has been published yet. Monitor the sources for updates.