{"id":"CVE-2026-66065","summary":"Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)","details":"Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still reach arbitrary command execution by shipping a .env (auto-loaded at import, with no review step). The CVE-2026-47211 fix added _UNTRUSTED_ENV_DENYLIST to stop an untrusted project-directory .env from redirecting execution, but it did not account for all keys. The backend config-home and MCP/plugin roots bypass the approval gate by pointing the nested agent, MCP servers, and plugin roster at attacker config. Other variables re-enable blocked local transports, replace sub-agent prompts, switch backends, and lower tool approval classes, further weakening the approval gate. This issue has been fixed in version 0.42.1.","aliases":["GHSA-jv2h-4p9v-wf5w"],"modified":"2026-08-06T03:31:19.096242523Z","published":"2026-08-03T20:20:27.599Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-15","CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66065.json"},"references":[{"type":"WEB","url":"https://github.com/Q00/ouroboros/releases/tag/v0.42.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66065.json"},{"type":"ADVISORY","url":"https://github.com/Q00/ouroboros/security/advisories/GHSA-jv2h-4p9v-wf5w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66065"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/q00/ouroboros","events":[{"introduced":"0"},{"fixed":"68b4822cbcbb822c6f25384f01a50529e107676a"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.42.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v0.42.0","v0.41.0","v0.40.1","v0.40.0","v0.39.1","v0.39.0","v0.38.2","v0.38.1","v0.38.0","v0.37.0","v0.36.0","v0.35.0","v0.34.0","v0.33.0","v0.32.0","v0.31.1","v0.31.0","v0.30.0","v0.29.2","v0.29.1","v0.29.0","v0.28.8","v0.28.7","v0.28.6","v0.28.5","v0.28.4","v0.28.3","v0.28.2","v0.28.1","v0.28.0","v0.27.2","v0.27.1","v0.26.6","v0.27.0","v0.26.5","v0.26.4","v0.26.3","v0.26.2","v0.26.1","v0.26.0","v0.25.2","v0.25.1","v0.25.0","v0.24.0","v0.23.2","v0.23.1","v0.23.0","v0.22.0","v0.21.1","v0.21.0","v0.20.0","v0.19.1","v0.19.0","v0.18.1","v0.18.0","v0.17.0","v0.16.0","v0.15.0","v0.14.1","v0.14.0","v0.13.7","v0.13.6","v0.13.5","v0.13.4","v0.13.3","v0.13.0","v0.12.2","v0.12.1","v0.12.0","v0.9.0","v0.8.0","v0.7.0","v0.6.0","v0.5.1","v0.5.0","v0.4.1","v0.4.0","v0.3.0","v0.2.3","v0.2.2","v0.2.1","v0.2.0","v0.1.1","v0.1.0a1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66065.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}