Description
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code execution and potential system takeover. The vulnerability stems from Ouroboros loading the .env file from the current working directory. Execution-affecting environment variables such as OUROBOROS_CLI_PATH, OPENCODE_CLI_PATH, and other backend selectors are accepted directly from this local .env. An attacker can include a malicious script in the repository and point the CLI path variable to it (e.g., OUROBOROS_CLI_PATH=./malicious_script.sh). When the user executes a command like ouroboros init or any command that instantiates the adapter, the malicious script is executed instead of the intended CLI. This issue has been fixed in version 0.39.0.
Published: 2026-08-03
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in Ouroboros’ loading of a .env file from the current working directory. When a user runs Ouroboros commands in a directory that contains a malicious .env, the tool accepts execution‑affecting variables such as OUROBOROS_CLI_PATH or OPENCODE_CLI_PATH. An attacker can set one of these variables to point to a custom script packaged in the repository. The ensuing command execution will launch the attacker‑supplied script instead of the intended CLI, giving the attacker arbitrary code execution and potentially full system takeover. The weakness is classified as CWE‑426.

Affected Systems

The vulnerability affects the Q00:ouroboros runtime for AI coding agents. All releases prior to 0.39.0 are susceptible. The issue was fixed in version 0.39.0, so users of 0.38.x and earlier should be aware.

Risk and Exploitability

The CVSS score of 8.4 indicates a high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a malicious repository to be cloned locally and the user to run an Ouroboros command within that directory. The vulnerability is exploitable by a local user with the ability to control the repository contents, and it does not require network access.

Generated by OpenCVE AI on August 4, 2026 at 09:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Ouroboros to version 0.39.0 or later.
  • Refrain from running Ouroboros commands inside directories that contain untrusted .env files; execute commands from a separate clean directory or delete any .env files before running.
  • Consider configuring Ouroboros to skip loading .env files from the current working directory if such an option is available in the configuration or by setting an environment variable that disables this behavior.

Generated by OpenCVE AI on August 4, 2026 at 09:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-c4m7-2gwp-vw76 ouroboros-ai Vulnerable to Remote Code Execution via Untrusted Project-Directory .env
History

Wed, 05 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Q00
Q00 ouroboros
Vendors & Products Q00
Q00 ouroboros

Mon, 03 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code execution and potential system takeover. The vulnerability stems from Ouroboros loading the .env file from the current working directory. Execution-affecting environment variables such as OUROBOROS_CLI_PATH, OPENCODE_CLI_PATH, and other backend selectors are accepted directly from this local .env. An attacker can include a malicious script in the repository and point the CLI path variable to it (e.g., OUROBOROS_CLI_PATH=./malicious_script.sh). When the user executes a command like ouroboros init or any command that instantiates the adapter, the malicious script is executed instead of the intended CLI. This issue has been fixed in version 0.39.0.
Title Ouroboros: Remote Code Execution via Untrusted Project-Directory .env
Weaknesses CWE-426
References
Metrics cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Q00 Ouroboros
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-03T21:19:05.967Z

Reserved: 2026-05-18T22:25:21.258Z

Link: CVE-2026-47211

cve-icon Vulnrichment

Updated: 2026-08-03T21:06:59.028Z

cve-icon NVD

Status : Received

Published: 2026-08-03T20:17:24.030

Modified: 2026-08-03T22:16:49.327

Link: CVE-2026-47211

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T10:21:33Z

Weaknesses