CVE-2026-47211: 
Python vulnerability analysis and mitigation

CVE-2026-47211 is a Remote Code Execution (RCE) vulnerability in the ouroboros-ai Python package (pip) that allows an attacker to execute arbitrary code on a victim's machine by distributing a malicious repository containing a crafted .env file. It affects all versions of ouroboros-ai prior to 0.39.0. The vulnerability was first published by the maintainer on May 20, 2026, and added to the GitHub Advisory Database on May 29, 2026. It carries a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Ouroboros Advisory).

The root cause is an untrusted search path issue (CWE-426: Untrusted Search Path; CWE-15: External Control of System Setting) in src/ouroboros/config/loader.py, which loaded the .env file from the current working directory at import time with the same level of trust as the user's home configuration (~/.ouroboros/.env). Execution-affecting environment variables — including OUROBOROS_CLI_PATH, OPENCODE_CLI_PATH, runtime/backend selectors (OUROBOROS_AGENT_RUNTIME, OUROBOROS_RUNTIME, OUROBOROS_LLM_BACKEND), and permission-mode overrides (OUROBOROS_AGENT_PERMISSION_MODE) — were read directly from this untrusted project-directory .env and used to determine which binary the adapter spawned via subprocess.run. An attacker crafts a repository containing a malicious .env (e.g., OUROBOROS_CLI_PATH=./malicious_script.sh) and an executable script; when the victim clones the repo and runs any Ouroboros command that instantiates an adapter (e.g., ouroboros init), the malicious script is executed instead of the intended CLI (GitHub Advisory, Fix PR #1078).

Successful exploitation grants the attacker arbitrary code execution on the victim's system with the privileges of the user running Ouroboros commands. This can result in full confidentiality, integrity, and availability compromise of the vulnerable system — including credential theft, data exfiltration, installation of persistent backdoors, or complete system takeover. Additionally, the permission-mode override vectors (OUROBOROS_AGENT_PERMISSION_MODE=bypassPermissions) could silently disable the user's approval gate, allowing a malicious repository to auto-approve arbitrary tool calls without user interaction (GitHub Advisory, Ouroboros Advisory).

1. Craft a malicious repository: Create a Git repository containing two files: a .env file with OUROBOROS_CLI_PATH=./malicious_script.sh (or any other denylisted variable such as OPENCODE_CLI_PATH=./evil.sh), and an executable shell script (malicious_script.sh) containing the attacker's payload (e.g., a reverse shell or credential harvester).
2. Make the script executable: Ensure malicious_script.sh has execute permissions (chmod +x malicious_script.sh) and commit both files to the repository.
3. Distribute the repository: Host the malicious repository on a public or private platform (e.g., GitHub, GitLab) and socially engineer the victim into cloning it — for example, by disguising it as a legitimate project, tool, or code sample.
4. Wait for victim to run Ouroboros: When the victim clones the repository and runs any Ouroboros command within that directory (e.g., ouroboros init, ooo), loader.py loads the .env at import time, setting OUROBOROS_CLI_PATH to ./malicious_script.sh.
5. Achieve code execution: When the adapter is instantiated, it resolves the CLI path to the malicious script and executes it via subprocess.run, running the attacker's payload with the victim's user privileges (GitHub Advisory, Fix PR #1078).

• File System: Presence of a .env file in a cloned repository directory containing entries for OUROBOROS_CLI_PATH, OUROBOROS_CODEX_CLI_PATH, OUROBOROS_COPILOT_CLI_PATH, OUROBOROS_KIRO_CLI_PATH, OUROBOROS_OPENCODE_CLI_PATH, OUROBOROS_HERMES_CLI_PATH, OUROBOROS_GOOSE_CLI_PATH, OUROBOROS_GEMINI_CLI_PATH, or OPENCODE_CLI_PATH pointing to relative paths (e.g., ./script.sh); presence of unexpected executable shell scripts in a cloned repository directory.
• Process: Unexpected child processes spawned by the Ouroboros Python process (e.g., /bin/bash, sh, python, curl, wget) immediately after running an Ouroboros command; processes executing scripts from within a repository's working directory.
• Environment: Runtime environment variables OUROBOROS_CLI_PATH, OPENCODE_CLI_PATH, OUROBOROS_AGENT_RUNTIME, OUROBOROS_RUNTIME, OUROBOROS_LLM_BACKEND, OUROBOROS_AGENT_PERMISSION_MODE, OUROBOROS_LLM_PERMISSION_MODE, or OUROBOROS_OPENCODE_PERMISSION_MODE set to unexpected values during an Ouroboros session.

Upgrade ouroboros-ai to version 0.39.0 or later, which introduces a denylist (_UNTRUSTED_ENV_DENYLIST) in config/loader.py that blocks all execution-affecting environment variables from being loaded from the project-directory .env; the _load_env_file function now defaults to trusted=False (fail-closed), and only ~/.ouroboros/.env is treated as trusted (GitHub Advisory, Fix Commit). If an immediate upgrade is not possible, manually inspect any .env file in a cloned repository before running Ouroboros commands, and ensure it does not contain OUROBOROS_*_CLI_PATH, OPENCODE_CLI_PATH, runtime selectors, or permission-mode overrides pointing to relative paths. Avoid running Ouroboros commands inside untrusted or unreviewed repository directories until the patch is applied (Ouroboros Advisory).

The vulnerability was reported by security researcher qerogram and addressed by the Ouroboros maintainer (Q00) via an adversarially reviewed pull request (PR #1078), which underwent two rounds of security review by an automated security agent (ouroboros-agent[bot]) before approval (Fix PR #1078). The review process surfaced multiple bypass vectors — including the missing OPENCODE_CLI_PATH bare alias and permission-mode override variables — which were all addressed before the fix was merged. No broader media coverage or notable community discussion beyond the GitHub advisory and PR has been identified at this time.