CVE-2026-66065

Received Received - Intake

Remote Code Execution in Ouroboros AI Coding Agent

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still reach arbitrary command execution by shipping a .env (auto-loaded at import, with no review step). The CVE-2026-47211 fix added _UNTRUSTED_ENV_DENYLIST to stop an untrusted project-directory .env from redirecting execution, but it did not account for all keys. The backend config-home and MCP/plugin roots bypass the approval gate by pointing the nested agent, MCP servers, and plugin roster at attacker config. Other variables re-enable blocked local transports, replace sub-agent prompts, switch backends, and lower tool approval classes, further weakening the approval gate. This issue has been fixed in version 0.42.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-66065

EUVD

EUVD-2026-52428

Affected Vendors & Products

Vendor	Product	Version / Range
ouroboros	ouroboros	to 0.42.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-15	One or more system settings or configuration elements can be externally controlled by a user.

Attack-Flow Graph

Executive Summary

Ouroboros is a runtime for AI coding agents that records actions and enforces user policies. Prior to version 0.42.1, a denylist missed several execution-routing keys of the same remote code execution class. This allowed a malicious cloned repository to bypass restrictions by including a .env file, which is auto-loaded without review. The fix for CVE-2026-47211 added _UNTRUSTED_ENV_DENYLIST but did not cover all keys, enabling attackers to manipulate config-home, MCP/plugin roots, and other variables to regain arbitrary command execution.

Detection Guidance

This vulnerability involves incomplete denylist enforcement in Ouroboros versions prior to 0.42.1, allowing malicious .env files or config paths to bypass security controls. Detection requires checking installed versions and reviewing configuration files for untrusted .env usage or unexpected config-home/MCP/plugin root paths.

Impact Analysis

If you use Ouroboros versions prior to 0.42.1, an attacker could trick you into cloning a malicious repository. This could lead to arbitrary command execution on your system, potentially allowing the attacker to take control of your machine, steal data, or install malware. The attack exploits auto-loaded .env files and misconfigured execution paths.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or loss of sensitive information. Such incidents may violate GDPR (data protection), HIPAA (health data privacy), or other regulations, resulting in legal penalties, fines, or reputational damage due to compromised confidentiality and integrity of systems.

Mitigation Strategies

Upgrade Ouroboros to version 0.42.1 or later to address the incomplete denylist and related issues. Review and restrict access to config-home and MCP/plugin roots to prevent bypassing the approval gate.

Hi! I’m here to help you understand CVE-2026-66065. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70