Which versions of Ouroboros are affected by EUVD-2026-52428?

Ouroboros Python package (versions ≤0.42.0) contains a critical command execution vulnerability triggered when developers execute ooo commands within malicious repositories.. A patch is available.

How to fix or mitigate EUVD-2026-52428?

Within 24 hours, identify all systems using Ouroboros ≤0.42.0 and instruct development teams to discontinue use of the package pending update. Within 7 days, upgrade to version 0.42.1 or later across all development environments, verify successful installation, and confirm the ooo command no longer loads untrusted environment variables or mcp_servers.yaml files. Within 30 days, audit development activity and environment logs from the 72-hour window preceding patch deployment to identify any suspicious environment variable modifications, unauthorized .ouroboros directory access, or unexpected command execution that may indicate prior exploitation.

Ouroboros EUVD-2026-52428

Q: What is the CVSS score of EUVD-2026-52428?

EUVD-2026-52428 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-66065 HIGH

External Control of System or Configuration Setting (CWE-15)

2026-08-03 GitHub_M

Authentication Bypass Ouroboros

8.4

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local vector and user interaction required (victim runs ooo in attacker directory); no victim-side privileges needed since attacker delivers payload via committed repo files.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Aug 03, 2026 - 21:17 EUVD

Source Code Evidence Fetched

Aug 03, 2026 - 21:06 vuln.today

Analysis Generated

Aug 03, 2026 - 21:06 vuln.today

CVE Published

Aug 03, 2026 - 20:20 cve.org

HIGH 8.4

DescriptionCVE.org

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still reach arbitrary command execution by shipping a .env (auto-loaded at import, with no review step). The CVE-2026-47211 fix added _UNTRUSTED_ENV_DENYLIST to stop an untrusted project-directory .env from redirecting execution, but it did not account for all keys. The backend config-home and MCP/plugin roots bypass the approval gate by pointing the nested agent, MCP servers, and plugin roster at attacker config. Other variables re-enable blocked local transports, replace sub-agent prompts, switch backends, and lower tool approval classes, further weakening the approval gate. This issue has been fixed in version 0.42.1.

AnalysisAI

Arbitrary command execution in Ouroboros (ouroboros-ai pip package, versions <= 0.42.0) is reachable when a developer runs ooo inside a malicious cloned repository, due to an incomplete denylist that left several execution-routing environment variable keys unblocked. The 0.39.0 fix for CVE-2026-47211 introduced _UNTRUSTED_ENV_DENYLIST but omitted keys spanning backend config-home roots, MCP bridge config, plugin trust roots, SSRF transport toggles, and capability override paths - all of which are auto-loaded from a project-directory .env at import with no review step. A separate code path additionally auto-loaded ./.ouroboros/mcp_servers.yaml from the current working directory, enabling RCE with no .env file at all. No public exploit code has been identified at time of analysis, though the GHSA advisory provides sufficient technical specificity for independent derivation. Vendor-released patch 0.42.1 resolves both attack surfaces.

Technical ContextAI

Ouroboros (CPE: cpe:2.3:a:q00:ouroboros:*:*:*:*:*:*:*:*) is a local-first Python runtime for AI coding agents that enforces user-defined behavioral policies. The root cause is CWE-15 (External Control of System or Configuration Setting): the runtime unconditionally auto-loads a project-directory .env at import time without a user review step, then uses the resolved environment to configure nested agent backends, MCP bridge servers, and plugin dispatch. The partial predecessor fix (CVE-2026-47211, 0.39.0) introduced _UNTRUSTED_ENV_DENYLIST but omitted keys in four functional classes: (1) backend config-home roots (CODEX_HOME, OPENCODE_CONFIG, OPENCODE_CONFIG_DIR, XDG_CONFIG_HOME) that redirect spawned vendor CLIs to attacker-supplied config.toml, enabling mcp_servers.<name>.command/args RCE and approval_policy=never; (2) MCP bridge and plugin roster keys (OUROBOROS_MCP_CONFIG, OUROBOROS_PLUGIN_LOCKFILE, OUROBOROS_PLUGIN_TRUST_ROOT) whose values are passed directly to stdio_client as a spawn target; (3) an SSRF guard toggle (OUROBOROS_ALLOW_LOCAL_TRANSPORT) that re-enables loopback/private MCP transports; and (4) instruction and capability override roots (OUROBOROS_AGENTS_DIR, COPILOT_CUSTOM_INSTRUCTIONS_DIRS, OUROBOROS_RUNTIME_PROFILE, OUROBOROS_TOOL_CAPABILITIES) that replace sub-agent prompts and lower tool approval classes. A wholly separate code path in create_bridge_from_env(cwd=Path.cwd()) auto-loaded ./.ouroboros/mcp_servers.yaml from the working directory, spawning the committed roster's command field as RCE with no .env involvement.

RemediationAI

Upgrade ouroboros-ai to version 0.42.1, which adds all omitted execution-routing keys to _UNTRUSTED_ENV_DENYLIST and removes the cwd-based auto-discovery of ./.ouroboros/mcp_servers.yaml, leaving only the explicit OUROBOROS_MCP_CONFIG environment variable and ~/.ouroboros/mcp_servers.yaml (both in the trusted user home) as valid MCP config sources. Release notes and changelog are available at https://github.com/Q00/ouroboros/releases/tag/v0.42.1; the security advisory is at https://github.com/Q00/ouroboros/security/advisories/GHSA-jv2h-4p9v-wf5w. If immediate upgrade is not possible, the vendor-documented workaround is: do not run Ouroboros from an untrusted or cloned repository directory; before invoking ooo, manually remove any project-directory .env file and .ouroboros/mcp_servers.yaml from the working directory. The trade-off of this workaround is that it relies on per-session manual inspection and is error-prone in automated CI/CD or scripted developer environments where directory context may change without review.