Ouroboros versions before 0.42.1 suffer from an incomplete denylist allowing external control of system or configuration settings (CWE-15) and potential code injection (CWE-94). Malicious .env files auto-loaded at import can redirect execution to arbitrary commands. The prior fix (CVE-2026-47211) introduced _UNTRUSTED_ENV_DENYLIST to block untrusted .env files but omitted several execution-routing keys. Attackers can exploit this to bypass approval gates by manipulating backend config-home and MCP/plugin roots, re-enable blocked transports, alter sub-agent prompts, switch backends, and lower tool approval classes. The issue is resolved in version 0.42.1.

An attacker who controls a cloned project repository can execute arbitrary commands locally by shipping a malicious .env file that bypasses the denylist. This can lead to unauthorized execution of code, manipulation of agent behavior, and weakening of security approval mechanisms. The vulnerability affects local deployments and can compromise the integrity and security of the AI coding agent runtime environment.

This vulnerability has been fixed in ouroboros version 0.42.1. Users should upgrade to version 0.42.1 or later to remediate this issue. No other mitigation or temporary workaround is indicated. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the description confirms the issue is fixed in 0.42.1.