CVE-2026-66065 ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
Attackers can achieve remote code execution by shipping a malicious .env file in a cloned repository, bypassing approval gates in the Ouroboros AI agent runtime.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-66065?
CVE-2026-66065 is a high-severity code injection vulnerability in Q00 ouroboros, published on 3 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still reach arbitrary command execution by shipping a .env (auto-loaded at import, with no review step). The CVE-2026-47211 fix added _UNTRUSTED_ENV_DENYLIST to stop an untrusted project-directory .env from redirecting execution, but it did not account for all keys. The backend config-home and MCP/plugin roots bypass the approval gate by pointing the nested agent, MCP servers, and plugin roster at attacker config. Other variables re-enable blocked local transports, replace sub-agent prompts, switch backends, and lower tool approval classes, further weakening the approval gate. This issue has been fixed in version 0.42.1.
Which versions are affected by CVE-2026-66065?
2 open source packages ship an affected version, including ouroboros-ai.
| Package | Affected | Fixed in |
|---|---|---|
ouroboros-ai PyPI | All versions | 0.42.1 |
ouroboros-ai PyPI | All versions | 0.42.1 |
How do I fix CVE-2026-66065?
Upgrade ouroboros-ai to 0.42.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-66065 being exploited?
There is no known exploitation of CVE-2026-66065 in the wild and no public exploit code.
Sources
Also known as GHSA-jv2h-4p9v-wf5w.