Ouroboros
Monthly
Arbitrary command execution in Ouroboros (ouroboros-ai pip package, versions <= 0.42.0) is reachable when a developer runs `ooo` inside a malicious cloned repository, due to an incomplete denylist that left several execution-routing environment variable keys unblocked. The 0.39.0 fix for CVE-2026-47211 introduced `_UNTRUSTED_ENV_DENYLIST` but omitted keys spanning backend config-home roots, MCP bridge config, plugin trust roots, SSRF transport toggles, and capability override paths - all of which are auto-loaded from a project-directory `.env` at import with no review step. A separate code path additionally auto-loaded `./.ouroboros/mcp_servers.yaml` from the current working directory, enabling RCE with no `.env` file at all. No public exploit code has been identified at time of analysis, though the GHSA advisory provides sufficient technical specificity for independent derivation. Vendor-released patch 0.42.1 resolves both attack surfaces.
Arbitrary command execution in Ouroboros (ouroboros-ai pip package, versions <= 0.42.0) is reachable when a developer runs `ooo` inside a malicious cloned repository, due to an incomplete denylist that left several execution-routing environment variable keys unblocked. The 0.39.0 fix for CVE-2026-47211 introduced `_UNTRUSTED_ENV_DENYLIST` but omitted keys spanning backend config-home roots, MCP bridge config, plugin trust roots, SSRF transport toggles, and capability override paths - all of which are auto-loaded from a project-directory `.env` at import with no review step. A separate code path additionally auto-loaded `./.ouroboros/mcp_servers.yaml` from the current working directory, enabling RCE with no `.env` file at all. No public exploit code has been identified at time of analysis, though the GHSA advisory provides sufficient technical specificity for independent derivation. Vendor-released patch 0.42.1 resolves both attack surfaces.