CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad



GHSA-JV2H-4P9V-WF5W

GHSA-JV2H-4P9V-WF5W: Arbitrary Remote Code Execution via Incomplete Environment Denylist in Ouroboros AI

Alon Barad
Alon Barad
Software Engineer

Jun 19, 2026·6 min read·15 visits

Executive Summary (TL;DR)

Ouroboros AI is vulnerable to arbitrary remote code execution via untrusted environment variables and working directory configurations, allowing attackers to run arbitrary system commands by getting a user to execute Ouroboros inside a cloned repository.

An arbitrary Remote Code Execution (RCE) vulnerability exists in ouroboros-ai due to an incomplete fix for CVE-2026-47211. Ouroboros automatically loads environment configurations from local .env files located in the current working directory (CWD) of cloned repositories. Although a denylist (_UNTRUSTED_ENV_DENYLIST) was introduced in version 0.39.0 to filter out execution-routing environment variables, multiple critical configuration variables were omitted, enabling complete sandbox bypass and arbitrary system command execution.

Vulnerability Overview

The affected component is the environment loader and execution configuration parser of ouroboros-ai. This component automatically processes and loads local environment configuration parameters from files within the current working directory. This exposure is particularly critical during command-line execution when parsing code repositories.

The system configuration exposes a critical attack surface because the tool runs within user workspaces. When a user runs commands like ooo within a folder, the software auto-discovers and configures its environmental parameters relative to that localized directory. This trust model allows external repository objects to direct administrative behaviors.

The weakness belongs to CWE-426 (Untrusted Search Path) combined with CWE-15 (External Control of System or Configuration Setting). The vulnerability enables unauthenticated remote code execution. This bypass variant is possible due to incomplete boundary controls deployed in preceding hotfixes.

Root Cause Analysis

The architecture of ouroboros-ai automates environment staging by merging configuration variables from localized .env resource files in the current working directory. In version 0.39.0, an initial hotfix implemented a blocklist called _UNTRUSTED_ENV_DENYLIST to exclude explicit CLI execution paths. This initial filter blocked variables such as OUROBOROS_CLI_PATH to prevent immediate execution redirection.

However, this blocklist was structurally incomplete, leaving several downstream execution-controlling environment variables exposed to modification. Specifically, variables managing downstream configuration directories (CODEX_HOME, OPENCODE_CONFIG, OPENCODE_CONFIG_DIR, XDG_CONFIG_HOME) were not filtered. When Ouroboros starts, it spawns downstream processes that locate their configurations relative to these environment values.

Additionally, secondary execution-altering mechanisms, including OUROBOROS_MCP_CONFIG and OUROBOROS_PLUGIN_LOCKFILE, were left exposed. If these are redirected to directories managed by an attacker, arbitrary plugin execution blocks can be initiated during routine tasks. This omission invalidates the isolation goals of the trust boundary, enabling command hijacking without modifying primary CLI paths.

Furthermore, the Model Context Protocol (MCP) bridge featured a secondary zero-configuration vulnerability. If a directory named .ouroboros containing mcp_servers.yaml existed within the current working directory, the system performed automated discovery by parsing configuration definitions. This meant that simply executing the core program within an untrusted repository initiated a malicious execution bridge, even in the complete absence of a .env file.

Code Analysis and Comparative Diff

In version 0.39.0, the system defined _UNTRUSTED_ENV_DENYLIST in src/ouroboros/config/loader.py with an incomplete scope, omitting secondary path controls:

# Vulnerable implementation in 0.39.0
_UNTRUSTED_ENV_DENYLIST = frozenset(
    {
        "OUROBOROS_CLI_PATH",
        "OUROBOROS_CODEX_CLI_PATH",
        "OUROBOROS_COPILOT_CLI_PATH",
        "OUROBOROS_KIRO_CLI_PATH",
        "OUROBOROS_OPENCODE_CLI_PATH",
        "OUROBOROS_HERMES_CLI_PATH",
        "OUROBOROS_GOOSE_CLI_PATH",
        "OUROBOROS_GEMINI_CLI_PATH",
        "OPENCODE_CLI_PATH",
        "OUROBOROS_AGENT_RUNTIME",
        "OUROBOROS_RUNTIME",
        "OUROBOROS_LLM_BACKEND",
        "OUROBOROS_AGENT_PERMISSION_MODE",
        "OUROBOROS_LLM_PERMISSION_MODE",
        "OUROBOROS_OPENCODE_PERMISSION_MODE",
    }
)

The loader applied this list inside the environment parser. However, because keys like CODEX_HOME and OUROBOROS_MCP_CONFIG were missing, they bypassed the filter block and entered the active runtime context.

In version 0.42.1, the blocklist was expanded to cover these omissions, and the current working directory auto-discovery code path in the MCP bridge was removed. The application now requires explicit home-directory configuration or verified environment variables:

# Patched implementation in 0.42.1
_UNTRUSTED_ENV_DENYLIST = frozenset(
    {
        # Original Executable Overrides
        "OUROBOROS_CLI_PATH",
        "OUROBOROS_CODEX_CLI_PATH",
        # ...
        # Backend config-home roots
        "CODEX_HOME",
        "OPENCODE_CONFIG",
        "OPENCODE_CONFIG_DIR",
        "XDG_CONFIG_HOME",
        # MCP bridge / plugin execution roster
        "OUROBOROS_MCP_CONFIG",
        "OUROBOROS_PLUGIN_LOCKFILE",
        "OUROBOROS_PLUGIN_TRUST_ROOT",
        # SSRF guard toggle
        "OUROBOROS_ALLOW_LOCAL_TRANSPORT",
        # Instruction / capability roots
        "OUROBOROS_AGENTS_DIR",
        "COPILOT_CUSTOM_INSTRUCTIONS_DIRS",
        "OUROBOROS_RUNTIME_PROFILE",
        "OUROBOROS_TOOL_CAPABILITIES",
    }
)

> [!NOTE] > The auto-discovery function was also corrected by removing cwd=Path.cwd() inside create_bridge_from_env. The application now resolves configuration paths exclusively from trusted system levels.

Exploitation Methodology

An attack relies on a user performing standard terminal interactions within an untrusted repository path. The adversary crafts a multi-layered folder structure containing a custom .env pointing downstream paths toward a controlled target. In addition, they supply a simulated local configuration structure in a hidden directory.

For example, configuring CODEX_HOME redirects the downstream agent execution cycle. When the core application calls the CLI interface, it inherits the configured CODEX_HOME variable, resolving files inside the malicious repository directory. The application subsequently initializes settings defined in .evil/config.toml rather than system-wide structures.

This malicious configuration file instructs the system to register custom servers with execution arguments. When execution flows reach these hooks, the tool initiates the command line arguments without prompting the operator. This execution bypasses user confirmation screens, initiating commands directly through Python's execution environment.

Technical Impact and Consequences

The impact of this vulnerability is complete compromise of the execution context hosting the ouroboros-ai package. Since many deployments are evaluated by local developers, software engineers, or automation routines, commands execute with the security permissions of the logged-in host user. An attacker can execute arbitrary commands, download secondary payloads, and persist on the client system.

Furthermore, because Ouroboros handles security credentials, including API keys, tokens, and local development configurations, the compromise enables complete data extraction of all credentials accessible via environment storage. Compromise of these development hosts can quickly facilitate lateral movement across enterprise networks.

The CVSS v4.0 score of 8.8 (High/Critical) reflects the seriousness of the issue. While user interaction is a prerequisite, it requires only standard activities, such as traversing into a cloned folder and executing typical commands. This makes exploitation a low-complexity task with high likelihood.

Remediation and Security Hardening

The only comprehensive remediation is to upgrade ouroboros-ai to version 0.42.1 or higher. This update restricts automatic environment loading, expands the blocklist, and removes the current working directory auto-discovery code path from the MCP bridge.

If immediate updates are not feasible, you must enforce execution sandboxing. Never run Ouroboros utilities inside directories cloned from untrusted origins or shared file systems. Developers should clean environment structures and manually verify that no localized .env files or .ouroboros directories reside within their workspaces.

Organizations can also implement system-level security controls to block exploitation. Restricting execution parameters and establishing monitoring rules to detect unexpected process trees spawned from interpreter runtimes (such as Python spawning shell processes inside user folders) can help mitigate risks.

Fix Analysis (1)

Technical Appendix

CVSS Score
8.8/ 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Systems

Ouroboros AI systems utilizing command-line runtimes and local directory loading.

Affected Versions Detail

Product
Affected Versions
Fixed Version
ouroboros-ai
Q00
< 0.42.10.42.1
AttributeDetail
Vulnerability TypeCWE-426: Untrusted Search Path / CWE-15: External Control of System Configuration
Affected ComponentEnvironment Staging & MCP Bridge Configuration
Attack VectorNetwork / File system parsing
Exploit StatusProof of Concept (PoC) available
ImpactRemote Code Execution (RCE)
CISA KEV StatusNot Listed

MITRE ATT&CK Mapping

T1574.009Hijack Execution Flow: Path Interconnection / Path Pollution
Persistence
CWE-426
Untrusted Search Path

The application resolves path-based configurations relative to the current working directory, which may be controlled by an adversary.

Known Exploits & Detection

GitHub Security AdvisoryPoC demonstrating RCE via CODEX_HOME redirection and custom config.toml files.

References & Sources

  • [1]GitHub Security Advisory GHSA-jv2h-4p9v-wf5w
  • [2]Ouroboros Source Repository
  • [3]Fix Pull Request 1078

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•2 days ago•CVE-2026-58263
7.2

CVE-2026-58263: Mutation Cross-Site Scripting (mXSS) in Jodit Editor clean-html Sanitizer

CVE-2026-58263 is a high-severity Mutation Cross-Site Scripting (mXSS) vulnerability affecting Jodit Editor prior to version 4.12.28. The flaw exists in Jodit's built-in clean-html sanitizer plugin, which fails to securely parse and sanitize nested elements containing foreign namespaces like MathML and SVG. Attackers can bypass sanitization by smuggling malicious payload elements inside rawtext container tags like style inside a MathML node, leading to DOM mutation and unauthenticated arbitrary script execution in the context of the user's browser session.

Amit Schendel
Amit Schendel
10 views•6 min read
•2 days ago•CVE-2026-65841
5.3

CVE-2026-65841: Client-Side Cross-Site Scripting (XSS) via Foreign Namespace Sanitization Bypass in Jodit Editor

Jodit Editor versions prior to 4.13.6 are vulnerable to client-side Cross-Site Scripting (XSS). The clean-html plugin's sanitization routine performs case-sensitive lookups against uppercase-only element blacklists. When processing XML-based foreign namespaces such as SVG or MathML, DOM engines preserve the lowercase format of tags. Because Jodit's denyTags check fails to normalize tag casing, malicious script blocks nested inside foreign namespace elements completely bypass validation and serialize directly into the editor output.

Amit Schendel
Amit Schendel
7 views•6 min read
•2 days ago•CVE-2026-53510
8.1

CVE-2026-53510: Remote Code Execution via Dynamic WSDL Parsing in Savon Ruby SOAP Client

A critical code injection vulnerability exists in Savon, a widely used SOAP client library for Ruby, prior to version 2.17.2. The vulnerability resides within the Savon::Model.all_operations module, where operation names fetched from a target Web Services Description Language (WSDL) document are dynamically evaluated via module_eval without sanitization. An attacker capable of manipulating the target WSDL document (e.g., through Man-in-the-Middle attacks, DNS hijacking, or Server-Side Request Forgery) can execute arbitrary Ruby code in the context of the parent application process.

Alon Barad
Alon Barad
12 views•6 min read
•2 days ago•CVE-2026-53466
6.5

CVE-2026-53466: Integer Conversion Overflow in ImageMagick XCF Decoder

An integer conversion overflow vulnerability exists in the XCF decoder of ImageMagick before version 6.9.13-51 and 7.1.2-26. The issue arises from mixed-type arithmetic that promotes calculation results to floating-point representations, causing an undefined cast back to integer. Under optimizing compilers, this undefined behavior results in bounds checks being bypassed, allowing out-of-bounds heap reads.

Amit Schendel
Amit Schendel
6 views•6 min read
•2 days ago•CVE-2026-53599
7.5

CVE-2026-53599: Authenticated Remote Code Execution in REDAXO CMS via Mediapool File Upload Validation Bypass

An authenticated file upload validation bypass vulnerability exists in the REDAXO CMS Mediapool addon in versions 5.18.2 through 5.21.0. Under permissive web server configurations, this allows authenticated users with media upload privileges to achieve remote code execution via multi-segment extension file uploads.

Alon Barad
Alon Barad
9 views•7 min read
•2 days ago•CVE-2026-52887
10.0

CVE-2026-52887: Critical SQL Injection and Remote Code Execution in NocoBase

A critical SQL injection vulnerability exists in the @nocobase/plugin-notification-in-app-message plugin of NocoBase prior to version 2.0.61. The flaw is caused by direct string interpolation of user-controlled input into a Sequelize.literal() query, allowing authenticated users to execute stacked PostgreSQL queries and achieve remote code execution on the underlying database server.

Amit Schendel
Amit Schendel
14 views•7 min read