ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
- Product
- ouroboros-ai
- Affected
- ouroboros-ai <= 0.42.0
- Fixed in
- 0.42.1
Last verified against sources: October 26, 2026
Am I affected?
ouroboros-ai: affected ouroboros-ai <= 0.42.0. Fixed in 0.42.1.
- Check your version: run
pip show ouroboros-ai. Versions <= 0.42.0 of ouroboros-ai are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "ouroboros-ai>=0.42.1"(first patched version 0.42.1). [1] - Do not run Ouroboros from an untrusted/cloned repository directory; remove any project-directory
.envand./.ouroboros/mcp_servers.yamlbefore running. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- The CVE-2026-47211 fix (0.39.0) added
_UNTRUSTED_ENV_DENYLISTto stop an untrusted project-directory.envfrom redirecting execution. [1] - The denylist was incomplete — several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still reach arbitrary command execution by shipping a
.env(auto-loaded at import, no review step). [1] - The MCP bridge auto-loaded
./.ouroboros/mcp_servers.yamlfrom the working directory (create_bridge_from_env(cwd=Path.cwd())), so runningoooinside a malicious repo spawned the committed roster'scommand— RCE with no.envat all. [1]
Impact
CODEX_HOME=./.evil+ committed./.evil/config.tomlredirects the nested Codex agent to attacker config —mcp_servers.<name>.command/args(RCE) andapproval_policy="never"/sandbox_mode="danger-full-access"(silent removal of the human approval gate). [1]OUROBOROS_MCP_CONFIG(the YAML's servercommand/argsare spawned via stdio_client — RCE),OUROBOROS_PLUGIN_LOCKFILE,OUROBOROS_PLUGIN_TRUST_ROOT(redirect the installed-plugin roster / trust root soooo <name>dispatches into attacker code). [1]OUROBOROS_ALLOW_LOCAL_TRANSPORT(re-enables loopback/private MCP transport targets). [1]OUROBOROS_AGENTS_DIR,COPILOT_CUSTOM_INSTRUCTIONS_DIRS(replace spawned sub-agent role prompts),OUROBOROS_RUNTIME_PROFILE(backend selector),OUROBOROS_TOOL_CAPABILITIES(override YAML can lower a tool'sapproval_class, weakening the approval gate). [1]
What was done
- Fixed in 0.42.1. [1]
- All listed keys were added to
_UNTRUSTED_ENV_DENYLIST; the cwd auto-discovery branch was removed (only the explicitOUROBOROS_MCP_CONFIGenv var and~/.ouroboros/mcp_servers.yamlremain, both trusted). [1] - The regression suite now derives from the source denylist to prevent future drift. [1]
- Reported privately via coordinated disclosure by matte1782 and hackkim (https://github.com/hackkim). [1]
Sources
- GHSA-jv2h-4p9v-wf5w — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
Product: ouroboros-ai | Affected: ouroboros-ai <= 0.42.0 | Fixed in: 0.42.1
Summary: The CVE-2026-47211 fix (0.39.0) added `_UNTRUSTED_ENV_DENYLIST` to stop an untrusted project-directory `.env` from redirecting execution.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/06/ghsa-jv2h-4p9v-wf5w-ouroboros-aiCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for ouroboros-ai
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.