{"data":{"id":"1e6d4b8f-54e9-4abf-95fd-0f5787f0f037","title":"GHSA-c4m7-2gwp-vw76: ouroboros-ai Vulnerable to Remote Code Execution via Untrusted Project-Directory .env","summary":"Ouroboros loaded the `.env` file from the current working directory, so execution-affecting variables such as `OUROBOROS_CLI_PATH` and `OPENCODE_CLI_PATH` could be set by a malicious cloned repository. Running an Ouroboros command such as `ouroboros init` in that directory could execute an attacker's script instead of the intended CLI, leading to arbitrary code execution. The flaw is patched in version 0.39.0 via PR #1078.","solution":"Fixed in 0.39.0 (PR #1078): a denylist now blocks execution-affecting environment variables, such as runtime selectors and CLI path overrides, from being loaded from the project directory. Upgrade to version 0.39.0 or later. Workaround if upgrading is not immediately possible: inspect any `.env` file inside cloned repositories before running Ouroboros commands to ensure it does not contain unexpected `OUROBOROS_*_CLI_PATH` or `OPENCODE_CLI_PATH` overrides.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-c4m7-2gwp-vw76","publishedAt":"2026-05-29T21:22:41.000Z","cveId":"CVE-2026-47211","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["ouroboros-ai@< 0.39.0 (fixed: 0.39.0)"],"affectedPackageNames":["ouroboros-ai"],"affectedPackageRefs":["pypi:ouroboros-ai"],"affectedVendors":[],"affectedVendorsRaw":["ouroboros-ai","OpenCode CLI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00192,"epssCheckedAt":"2026-10-14T00:06:45.303Z","kevDateAdded":null,"advisoryAliases":["GHSA-c4m7-2gwp-vw76"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-29T21:22:41.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}