CVE-2026-66065: 
Python vulnerability analysis and mitigation

CVE-2026-66065 is an incomplete denylist vulnerability in Ouroboros, a local-first runtime for AI coding agents, that allows arbitrary command execution via malicious .env files or MCP roster files shipped in cloned repositories. It is a follow-on to CVE-2026-47211: the fix introduced in version 0.39.0 added _UNTRUSTED_ENV_DENYLIST but omitted several execution-routing environment variable keys of the same RCE class. All versions prior to 0.42.1 of the ouroboros-ai pip package are affected. The vulnerability was disclosed on June 18, 2026, via GitHub Security Advisory GHSA-jv2h-4p9v-wf5w and assigned a CVSS v4.0 base score of 8.4 (High) (GitHub Advisory, GitHub Release).

The root cause is classified under CWE-15 (External Control of System or Configuration Setting) and CWE-94 (Code Injection): Ouroboros auto-loads a project-directory .env file at import time with no user review step, and the denylist (_UNTRUSTED_ENV_DENYLIST in config/loader.py) introduced by the prior fix was incomplete. Omitted keys fall into four categories: (1) backend config-home roots (CODEX_HOME, OPENCODE_CONFIG, OPENCODE_CONFIG_DIR, XDG_CONFIG_HOME) that redirect nested vendor CLI agent configuration to attacker-controlled files enabling RCE and disabling approval gates; (2) MCP bridge/plugin roster keys (OUROBOROS_MCP_CONFIG, OUROBOROS_PLUGIN_LOCKFILE, OUROBOROS_PLUGIN_TRUST_ROOT) whose values are spawned via stdio_client, directly achieving RCE; (3) the SSRF guard toggle (OUROBOROS_ALLOW_LOCAL_TRANSPORT) that re-enables blocked local transports; and (4) instruction/capability roots (OUROBOROS_AGENTS_DIR, COPILOT_CUSTOM_INSTRUCTIONS_DIRS, OUROBOROS_RUNTIME_PROFILE, OUROBOROS_TOOL_CAPABILITIES) that replace sub-agent prompts and lower tool approval classes. Additionally, the MCP bridge auto-loaded ./.ouroboros/mcp_servers.yaml from the current working directory (create_bridge_from_env(cwd=Path.cwd())), enabling RCE with no .env file at all when running inside a malicious repository (GitHub Advisory).

Successful exploitation allows an attacker who controls a cloned repository to achieve arbitrary command execution on the victim's machine at the privilege level of the Ouroboros process, with no user review or approval step. Beyond direct RCE, attackers can silently remove the human approval gate (e.g., setting approval_policy="never" and sandbox_mode="danger-full-access" in a committed config file), redirect nested AI agents and MCP servers to attacker-controlled infrastructure, replace sub-agent role prompts, and re-enable SSRF transports — collectively resulting in high confidentiality, integrity, and availability impact on the vulnerable system (GitHub Advisory, GitHub Release).

1. Prepare malicious repository: Create or compromise a repository and add a .env file in the project root containing one or more of the omitted denylist keys, e.g., CODEX_HOME=./.evil or OUROBOROS_MCP_CONFIG=./.ouroboros/mcp_servers.yaml.
2. Commit attacker-controlled config: Add the referenced config file (e.g., .evil/config.toml with mcp_servers..command set to a malicious binary, approval_policy="never", and sandbox_mode="danger-full-access") or a .ouroboros/mcp_servers.yaml with a malicious command/args entry.
3. Lure victim: Socially engineer a developer using Ouroboros (versions < 0.42.1) to clone the repository.
4. Trigger auto-load: When the victim runs ooo or imports Ouroboros from within the cloned directory, the .env is auto-loaded at import time with no review prompt, setting the malicious environment variables.
5. Achieve RCE: Ouroboros spawns the nested vendor CLI or MCP server using the attacker-supplied config, executing the attacker's command with the victim's user privileges and with the human approval gate silently disabled.
6. Alternative (no .env required): Simply commit .ouroboros/mcp_servers.yaml to the repository; the create_bridge_from_env(cwd=Path.cwd()) code path auto-loads it when ooo is run from the repo directory, spawning the malicious command directly (GitHub Advisory).

• File System: Presence of a .env file in a cloned repository root containing keys such as CODEX_HOME, OPENCODE_CONFIG, OPENCODE_CONFIG_DIR, XDG_CONFIG_HOME, OUROBOROS_MCP_CONFIG, OUROBOROS_PLUGIN_LOCKFILE, OUROBOROS_PLUGIN_TRUST_ROOT, OUROBOROS_ALLOW_LOCAL_TRANSPORT, OUROBOROS_AGENTS_DIR, COPILOT_CUSTOM_INSTRUCTIONS_DIRS, OUROBOROS_RUNTIME_PROFILE, or OUROBOROS_TOOL_CAPABILITIES; presence of .ouroboros/mcp_servers.yaml in a cloned repository directory.
• File System: Unexpected config directories (e.g., .evil/, attacker-named directories) committed to a repository containing config.toml with approval_policy="never" or sandbox_mode="danger-full-access".
• Process: Unexpected child processes spawned by the Ouroboros runtime (e.g., shells, network utilities, or unknown binaries) that are not part of the normal agent workflow.
• Network: Outbound connections from the Ouroboros process to unexpected or attacker-controlled hosts, particularly over MCP/stdio transport channels or loopback addresses if OUROBOROS_ALLOW_LOCAL_TRANSPORT was set.

Upgrade to Ouroboros version 0.42.1 (pip install --upgrade ouroboros-ai), which adds all omitted keys to _UNTRUSTED_ENV_DENYLIST and removes the cwd auto-discovery branch for MCP roster loading. As an immediate workaround for users who cannot upgrade, do not run Ouroboros from within an untrusted or cloned repository directory; manually inspect and remove any project-directory .env and .ouroboros/mcp_servers.yaml files before running ooo. The regression suite in 0.42.1 now derives from the source denylist to prevent future drift (GitHub Advisory, GitHub Release).

The vulnerability was responsibly disclosed via GitHub's coordinated disclosure process by researchers matte1782 and hackkim, who identified multiple bypass vectors in the incomplete prior fix. The GitHub Security Advisory (GHSA-jv2h-4p9v-wf5w) provides a detailed rationale for treating all bypass vectors as a single CVE under CVE rule 4.2.11, noting they share one trust boundary and one impact class. No significant broader media coverage or social media commentary has been identified beyond standard vulnerability aggregator listings (GitHub Advisory).