vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-66065

Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)

HIGH
8.4
CVSS Score
Published: August 3, 2026 at 08:20 PM UTC
Updated: October 23, 2026 at 09:10 PM UTC
1 product affected across 1 vendorOuroboros

Using ouroboros by Q00?

Get instant alerts when new vulnerabilities affect ouroboros - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.4
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still reach arbitrary command execution by shipping a .env (auto-loaded at import, with no review step). The CVE-2026-47211 fix added _UNTRUSTED_ENV_DENYLIST to stop an untrusted project-directory .env from redirecting execution, but it did not account for all keys. The backend config-home and MCP/plugin roots bypass the approval gate by pointing the nested agent, MCP servers, and plugin roster at attacker config. Other variables re-enable blocked local transports, replace sub-agent prompts, switch backends, and lower tool approval classes, further weakening the approval gate. This issue has been fixed in version 0.42.1.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ouroboros· Q00
90%
v < 0.42.1
Affected range stops below 0.42.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (2)

x_refsource_CONFIRM
Source: cverecord
https://github.com/Q00/ouroboros/security/advisories/GHSA-jv2h-4p9v-wf5w
x_refsource_MISC
Source: cverecord
https://github.com/Q00/ouroboros/releases/tag/v0.42.1

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.4HIGHGitHub_M
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-15CWE-94

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card