CVE-2026-47211: Ouroboros AI Coding Agent RCE Vulnerability

CVE-2026-47211 Overview

CVE-2026-47211 is a local code execution vulnerability in Ouroboros, a local-first runtime for AI coding agents. Versions prior to 0.39.0 load the .env file from the current working directory and honor execution-affecting environment variables such as OUROBOROS_CLI_PATH and OPENCODE_CLI_PATH directly from that file. An attacker who publishes a malicious repository can point the CLI path to an in-repo script. When a victim runs ouroboros init or any command that instantiates the adapter, the attacker-controlled script executes instead of the intended CLI binary. The issue is fixed in version 0.39.0 and tracked under [CWE-426: Untrusted Search Path].

Critical Impact
Cloning and running Ouroboros inside a malicious repository yields arbitrary code execution under the invoking user, enabling full system takeover.

Affected Products

Ouroboros runtime versions prior to 0.39.0
AI coding agent workflows that invoke ouroboros init or adapter-instantiating commands
Development environments where users clone third-party repositories and run Ouroboros within them

Discovery Timeline

2026-08-03 - CVE-2026-47211 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-47211

Vulnerability Analysis

Ouroboros treats the project-directory .env file as a trusted configuration source. During startup, the loader reads execution-affecting variables including OUROBOROS_CLI_PATH, OUROBOROS_CODEX_CLI_PATH, OUROBOROS_COPILOT_CLI_PATH, OUROBOROS_OPENCODE_CLI_PATH, and other backend selectors. Because these variables control which binary the runtime spawns, sourcing them from a cloned repository collapses the trust boundary between configuration and executable content. Permission-mode overrides such as acceptEdits and bypassPermissions compound the impact by silently removing the human approval gate, allowing a malicious repository to auto-approve arbitrary tool calls.

Root Cause

The root cause is an untrusted search path issue in src/ouroboros/config/loader.py. The _load_env_file function accepted all keys from the working-directory .env without distinguishing execution-affecting variables from benign application settings. There was no denylist separating trusted sources (the real process environment, ~/.ouroboros/.env, ~/.ouroboros/config.yaml) from the project-local .env that travels with a cloned repository.

Attack Vector

Exploitation requires the victim to clone a malicious repository and run any Ouroboros command inside it. The attacker ships a .env file such as OUROBOROS_CLI_PATH=./malicious_script.sh alongside malicious_script.sh in the repository. When Ouroboros instantiates its adapter, it resolves the CLI path to the attacker's script and executes it with the invoking user's privileges.

python

# Security patch in src/ouroboros/config/loader.py (v0.39.0)
# Source: https://github.com/Q00/ouroboros/commit/4e70b760b4eb157469b58645339ba831f6513d37

_UNTRUSTED_ENV_DENYLIST = frozenset(
    {
        # Explicit executable-path overrides.
        "OUROBOROS_CLI_PATH",
        "OUROBOROS_CODEX_CLI_PATH",
        "OUROBOROS_COPILOT_CLI_PATH",
        "OUROBOROS_KIRO_CLI_PATH",
        "OUROBOROS_OPENCODE_CLI_PATH",
        "OUROBOROS_HERMES_CLI_PATH",
        # ... plus runtime/backend selectors and permission-mode overrides
    }
)
# These keys are only honored from trusted sources (real process
# environment, ~/.ouroboros/.env, ~/.ouroboros/config.yaml), never
# from the project-directory .env that travels with a cloned repo.

The patch enforces the trust boundary at the .env load site, stripping denylisted keys before they can reach downstream sinks like claude_code_adapter.py.

Detection Methods for CVE-2026-47211

Indicators of Compromise

Presence of .env files in cloned repositories that set OUROBOROS_CLI_PATH, OPENCODE_CLI_PATH, or other *_CLI_PATH variables to relative paths
Unexpected shell scripts or executables referenced by CLI path variables within a project directory
Ouroboros adapter spawning processes from paths inside a user's development workspace rather than from system CLI install locations
.env entries containing acceptEdits or bypassPermissions overrides in repositories obtained from untrusted sources

Detection Strategies

Scan developer workstations for repositories containing .env files with denylisted keys such as OUROBOROS_*_CLI_PATH
Alert on process ancestry where ouroboros spawns a child from a user-writable directory outside standard binary locations
Correlate execution of scripts inside recently cloned repositories with subsequent outbound network or credential-access activity

Monitoring Recommendations

Log all executions of ouroboros and its child processes with full command line and resolved binary path
Track file creation of .env and shell script pairs within source-controlled directories
Baseline the legitimate CLI binary paths for each adapter and alert on deviations

How to Mitigate CVE-2026-47211

Immediate Actions Required

Upgrade Ouroboros to version 0.39.0 or later on every developer workstation and CI runner
Audit existing project .env files for OUROBOROS_*_CLI_PATH, OPENCODE_CLI_PATH, acceptEdits, and bypassPermissions entries and remove any set by untrusted repositories
Treat any historical execution of ouroboros inside a third-party repository prior to patching as potentially compromising and investigate accordingly

Patch Information

The fix landed in Ouroboros 0.39.0 via GitHub Pull Request #1078 and commit 4e70b76. Refer to the GitHub Security Advisory GHSA-c4m7-2gwp-vw76 for full details. The patch introduces _UNTRUSTED_ENV_DENYLIST in src/ouroboros/config/loader.py to strip execution-affecting variables from project-directory .env files while still honoring them from the real process environment and user-level Ouroboros configuration.

Workarounds

Do not run Ouroboros commands inside repositories from untrusted sources until the upgrade is complete
Move legitimate CLI path overrides from project .env files to ~/.ouroboros/.env or ~/.ouroboros/config.yaml
Review each cloned repository's .env before executing any Ouroboros command, and remove or rename it if untrusted

bash

# Upgrade Ouroboros and remove untrusted overrides from a project .env
pip install --upgrade 'ouroboros>=0.39.0'

# Inspect a cloned repository for denylisted keys before running ouroboros
grep -E '^(OUROBOROS_[A-Z_]*CLI_PATH|OPENCODE_CLI_PATH|acceptEdits|bypassPermissions)=' .env || echo 'No denylisted keys found'