CVE-2026-47211: CWE-426: Untrusted Search Path in Q00 ouroboros
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code execution and potential system takeover. The vulnerability stems from Ouroboros loading the .env file from the current working directory. Execution-affecting environment variables such as OUROBOROS_CLI_PATH, OPENCODE_CLI_PATH, and other backend selectors are accepted directly from this local .env. An attacker can include a malicious script in the repository and point the CLI path variable to it (e.g., OUROBOROS_CLI_PATH=./malicious_script.sh). When the user executes a command like ouroboros init or any command that instantiates the adapter, the malicious script is executed instead of the intended CLI. This issue has been fixed in version 0.39.0.
AI Analysis
Technical Summary
The vulnerability in Ouroboros (CVE-2026-47211) arises from loading environment variables from a .env file in the current working directory without validation. This allows an attacker who can place a malicious repository locally to set environment variables such as OUROBOROS_CLI_PATH to point to malicious scripts. When the user runs Ouroboros commands that instantiate the CLI adapter, the malicious script executes instead of the legitimate CLI, leading to arbitrary code execution and potential system takeover. The issue is classified as CWE-426 (Untrusted Search Path) and affects versions prior to 0.39.0. The vulnerability has a CVSS 4.0 score of 8.4, indicating high severity.
Potential Impact
An attacker who can trick a user into running Ouroboros commands within a maliciously crafted repository directory can achieve arbitrary code execution with the privileges of the user running the commands. This can lead to full system compromise depending on user privileges. The vulnerability exploits the loading of environment variables from a local .env file, allowing execution of attacker-controlled scripts.
Mitigation Recommendations
Upgrade Ouroboros to version 0.39.0 or later, where this vulnerability has been fixed. Until upgrading, avoid running Ouroboros commands in directories containing untrusted or cloned repositories with potentially malicious .env files. There is no official patch advisory provided, but the fix is included in version 0.39.0.
CVE-2026-47211: CWE-426: Untrusted Search Path in Q00 ouroboros
Description
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code execution and potential system takeover. The vulnerability stems from Ouroboros loading the .env file from the current working directory. Execution-affecting environment variables such as OUROBOROS_CLI_PATH, OPENCODE_CLI_PATH, and other backend selectors are accepted directly from this local .env. An attacker can include a malicious script in the repository and point the CLI path variable to it (e.g., OUROBOROS_CLI_PATH=./malicious_script.sh). When the user executes a command like ouroboros init or any command that instantiates the adapter, the malicious script is executed instead of the intended CLI. This issue has been fixed in version 0.39.0.
CVSS v4.0
Score 8.4high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Ouroboros (CVE-2026-47211) arises from loading environment variables from a .env file in the current working directory without validation. This allows an attacker who can place a malicious repository locally to set environment variables such as OUROBOROS_CLI_PATH to point to malicious scripts. When the user runs Ouroboros commands that instantiate the CLI adapter, the malicious script executes instead of the legitimate CLI, leading to arbitrary code execution and potential system takeover. The issue is classified as CWE-426 (Untrusted Search Path) and affects versions prior to 0.39.0. The vulnerability has a CVSS 4.0 score of 8.4, indicating high severity.
Potential Impact
An attacker who can trick a user into running Ouroboros commands within a maliciously crafted repository directory can achieve arbitrary code execution with the privileges of the user running the commands. This can lead to full system compromise depending on user privileges. The vulnerability exploits the loading of environment variables from a local .env file, allowing execution of attacker-controlled scripts.
Mitigation Recommendations
Upgrade Ouroboros to version 0.39.0 or later, where this vulnerability has been fixed. Until upgrading, avoid running Ouroboros commands in directories containing untrusted or cloned repositories with potentially malicious .env files. There is no official patch advisory provided, but the fix is included in version 0.39.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-18T22:25:21.258Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a70f79ebf32cb7a34248225
Added to database: 08/03/2026, 20:18:38 UTC
Last enriched: 08/03/2026, 20:33:20 UTC
Last updated: 08/04/2026, 01:11:27 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.