CVE-2026-66065 Details
Description
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still reach arbitrary command execution by shipping a .env (auto-loaded at import, with no review step). The CVE-2026-47211 fix added _UNTRUSTED_ENV_DENYLIST to stop an untrusted project-directory .env from redirecting execution, but it did not account for all keys. The backend config-home and MCP/plugin roots bypass the approval gate by pointing the nested agent, MCP servers, and plugin roster at attacker config. Other variables re-enable blocked local transports, replace sub-agent prompts, switch backends, and lower tool approval classes, further weakening the approval gate. This issue has been fixed in version 0.42.1.
A denial-of-service vulnerability has been identified in Ouroboros AI versions prior to 0.42.1, stemming from an incomplete denylist for untrusted project-directory environment files. This flaw allows a malicious cloned repository to execute arbitrary commands by including a specially crafted .env file, which is automatically loaded without review. The issue arises because several execution-routing keys related to the same remote code execution class were overlooked, enabling the manipulation of execution behavior and the bypassing of user-defined policies.
Users should upgrade to Ouroboros AI version 0.42.1, which addresses this vulnerability by completing the denylist for untrusted environment files and removing the automatic loading of certain project-directory files that could be exploited. Instructions for downloading the latest version are available on the Ouroboros GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 3, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Q00/ouroboros/releases/tag/v0.42.1 | [email protected] | Release NotesVendor |
| https://github.com/Q00/ouroboros/security/advisories/GHSA-jv2h-4p9v-wf5w | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-15 | External Control of System or Configuration Setting | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ouroboros | <= 0.42.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |