Which versions of Ouroboros are affected by CVE-2026-47211?

ouroboros-ai (Python pip package) contains a remote code execution vulnerability affecting developers who use the tool within cloned repositories.. A patch is available.

How to fix or mitigate CVE-2026-47211?

Within 24 hours, enumerate all development systems with ouroboros-ai installed using pip auditing tools and notify development teams of the vulnerability and mandatory upgrade requirement. Within 7 days, deploy upgrade to version 0.39.0 through dependency management systems (pip, poetry, requirements.txt, etc.) and implement CI/CD policies to block installation of versions prior to 0.39.0. By day 30, audit development environment logs and credential access patterns from the past 30 days to identify potential exploitation, revoke any credentials that may have been exposed, and document findings in your incident response log.

Ouroboros CVE-2026-47211

Q: What is the CVSS score of CVE-2026-47211?

CVE-2026-47211 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-52425 HIGH

Untrusted Search Path (CWE-426)

2026-05-29 https://github.com/Q00/ouroboros

GHSA-c4m7-2gwp-vw76 PYSEC-2026-2857

RCE

8.4

CVSS 4.0 · Vendor: https://github.com/Q00/ouroboros

Severity by source

Vendor (https://github.com/Q00/ouroboros) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

AV:L because exploitation requires the victim to run a command inside a cloned directory; PR:N as the attacker needs no system privileges; UI:R for mandatory victim-initiated command execution.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/Q00/ouroboros).

CVSS VectorVendor: https://github.com/Q00/ouroboros

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Aug 03, 2026 - 20:37 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 03, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Aug 03, 2026 - 20:22 NVD

8.4 (HIGH)

Source Code Evidence Fetched

May 29, 2026 - 21:50 vuln.today

Analysis Generated

May 29, 2026 - 21:50 vuln.today

DescriptionCVE.org

Impact

A Remote Code Execution (RCE) vulnerability was discovered in Ouroboros. If a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code execution and potential system takeover.

The vulnerability (CWE-426: Untrusted Search Path & CWE-15: External Control of System Setting) stems from Ouroboros loading the .env file from the current working directory. Prior to the patch, execution-affecting environment variables such as OUROBOROS_CLI_PATH, OPENCODE_CLI_PATH, and other backend selectors were accepted directly from this local .env. An attacker could include a malicious script in the repository and point the CLI path variable to it (e.g., OUROBOROS_CLI_PATH=./malicious_script.sh). When the user executes a command like ouroboros init or any command that instantiates the adapter, the malicious script is executed instead of the intended CLI.

Patches

The vulnerability has been patched in version 0.39.0 via PR #1078. The fix establishes a strict trust boundary by applying a denylist to project-local .env loading. It blocks execution-affecting environment variables (such as runtime selectors and CLI path overrides) from being loaded from the project directory. Explicit constructor overrides and trusted user-owned home configurations (~/.ouroboros/.env) remain fully functional.

Users are strongly advised to upgrade to version 0.39.0 or later.

Workarounds

If upgrading is not immediately possible, users must carefully inspect any .env file inside cloned repositories before running Ouroboros commands to ensure it does not contain unexpected OUROBOROS_*_CLI_PATH or OPENCODE_CLI_PATH overrides.

References

GitHub PR: https://github.com/Q00/ouroboros/pull/1078

AnalysisAI

Remote code execution in ouroboros-ai (pip package) allows arbitrary command execution when a developer runs any Ouroboros command inside a cloned malicious repository. The tool unconditionally loaded .env from the current working directory with full trust, enabling an attacker-controlled OUROBOROS_CLI_PATH or similar variable to redirect subprocess calls to a malicious script. No public exploit or active exploitation (CISA KEV) has been confirmed; the fix is available in version 0.39.0 and the EPSS score of 0.56% (69th percentile) indicates moderate exploitation likelihood relative to the broader CVE population.

Technical ContextAI

Ouroboros (pkg:pip/ouroboros-ai) is a Python CLI tool that wraps multiple AI coding backends - Claude Code, Codex, Copilot, OpenCode, Goose, Gemini, and others - by spawning them as subprocesses. The root cause is CWE-426 (Untrusted Search Path) compounded by CWE-15 (External Control of System Setting): the config loader at src/ouroboros/config/loader.py called _load_env_file(Path('.env')) without a trust parameter, granting the project-directory .env the same authority as the user's home config (~/.ouroboros/.env). Variables such as OUROBOROS_CLI_PATH, OPENCODE_CLI_PATH, and backend selectors like OUROBOROS_RUNTIME and OUROBOROS_LLM_BACKEND directly control which executable is passed to subprocess.run. Additionally, permission-mode variables (OUROBOROS_AGENT_PERMISSION_MODE, OUROBOROS_LLM_PERMISSION_MODE) could silently disable the user's approval gate. The PR #1078 fix introduces a trusted boolean flag (defaulting to False, fail-closed) and a _UNTRUSTED_ENV_DENYLIST frozenset that strips all execution-redirecting and permission-overriding keys from untrusted .env files before they reach any downstream sink.

RemediationAI

Vendor-released patch: ouroboros-ai 0.39.0. Upgrade immediately via pip install --upgrade 'ouroboros-ai>=0.39.0'. The fix (commit 4e70b760b4eb157469b58645339ba831f6513d37, PR #1078) introduces a fail-closed denylist in src/ouroboros/config/loader.py that strips execution-redirecting and permission-override variables from untrusted project-directory .env files while leaving ~/.ouroboros/.env fully functional. If immediate upgrade is not possible, manually inspect every .env file in a cloned repository before running any Ouroboros command, specifically checking for OUROBOROS_CLI_PATH, OUROBOROS_CODEX_CLI_PATH, OUROBOROS_COPILOT_CLI_PATH, OUROBOROS_KIRO_CLI_PATH, OUROBOROS_OPENCODE_CLI_PATH, OUROBOROS_HERMES_CLI_PATH, OUROBOROS_GOOSE_CLI_PATH, OUROBOROS_GEMINI_CLI_PATH, OPENCODE_CLI_PATH, OUROBOROS_AGENT_RUNTIME, OUROBOROS_RUNTIME, OUROBOROS_LLM_BACKEND, OUROBOROS_AGENT_PERMISSION_MODE, OUROBOROS_LLM_PERMISSION_MODE, and OUROBOROS_OPENCODE_PERMISSION_MODE. The trade-off of manual inspection is human error - a single missed variable leads to full exploitation - making the upgrade the only reliable control. Advisory: https://github.com/Q00/ouroboros/security/advisories/GHSA-c4m7-2gwp-vw76.