CVE-2026-66065

HighCVSS 8.4

Published: 03/08/2026(UTC)Updated: 05/08/2026(UTC)Translated: 04/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

Ouroboros, a runtime for AI coding agents, prior to version 0.42.1, has an incomplete denylist. Despite a previous fix (CVE-2026-47211), some keys enabling remote code execution (RCE) were not blocked. A malicious repository can use a .env file to bypass security and execute arbitrary commands. Fixed in version 0.42.1.

Risk Assessment

An attacker can achieve remote code execution on the server, leading to full system compromise.

Recommendation

Immediately update Ouroboros to version 0.42.1 or later.

Other vulnerabilities in Ouroboros

CVE-2026-47211High
Ouroboros before version 0.39.0 loads the .env file from the current working directory, allowing injection of malicious environment variables. Cloning a malicious repository and running Ouroboros commands can lead to arbitrary code execution and system takeover.

Original NVD description (English source)

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still reach arbitrary command execution by shipping a .env (auto-loaded at import, with no review step). The CVE-2026-47211 fix added _UNTRUSTED_ENV_DENYLIST to stop an untrusted project-directory .env from redirecting execution, but it did not account for all keys. The backend config-home and MCP/plugin roots bypass the approval gate by pointing the nested agent, MCP servers, and plugin roster at attacker config. Other variables re-enable blocked local transports, replace sub-agent prompts, switch backends, and lower tool approval classes, further weakening the approval gate. This issue has been fixed in version 0.42.1.