Executive brief
Ouroboros, an AI agent framework, contains a vulnerability where it automatically loads configuration files from the current directory without user review. If a user runs the software inside a malicious or untrusted folder (such as a cloned repository), an attacker can execute arbitrary commands on the user's computer. This could lead to full system compromise, data theft, or the silent removal of security guardrails.
Technical details
The vulnerability stems from an incomplete fix for a previous issue (CVE-2026-47211) regarding the `_UNTRUSTED_ENV_DENYLIST`. Ouroboros-ai automatically loads `.env` files from the project directory at import time; several execution-routing keys (such as `CODEX_HOME`, `OUROBOROS_MCP_CONFIG`, and `XDG_CONFIG_HOME`) were omitted from the denylist, allowing an attacker to redirect configuration to malicious files. Additionally, the MCP bridge component automatically discovered and loaded `./.ouroboros/mcp_servers.yaml` from the current working directory. By shipping a malicious repository with these files, an attacker can achieve arbitrary command execution via the `command` and `args` fields in the redirected configurations. The issue is fixed in version 0.42.1 by expanding the denylist and removing CWD-based auto-discovery.
Affected products
- Q00 ouroboros-ai <= 0.42.0
Timeline
- 2026-06-18: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 0.42.1