GHSA-c4m7-2gwp-vw76: ouroboros-ai Vulnerable to Remote Code Execution via Untrusted Project-Directory .env

Summary

Ouroboros loaded the `.env` file from the current working directory, so execution-affecting variables such as `OUROBOROS_CLI_PATH` and `OPENCODE_CLI_PATH` could be set by a malicious cloned repository. Running an Ouroboros command such as `ouroboros init` in that directory could execute an attacker's script instead of the intended CLI, leading to arbitrary code execution. The flaw is patched in version 0.39.0 via PR #1078.

Mitigation

Fixed in 0.39.0 (PR #1078): a denylist now blocks execution-affecting environment variables, such as runtime selectors and CLI path overrides, from being loaded from the project directory. Upgrade to version 0.39.0 or later. Workaround if upgrading is not immediately possible: inspect any `.env` file inside cloned repositories before running Ouroboros commands to ensure it does not contain unexpected `OUROBOROS_*_CLI_PATH` or `OPENCODE_CLI_PATH` overrides.

Related items

• MediumCVE-2026-108759: mistral.rs sandbox escape via symlinks in mistralrs-code-execSimilar attack · NVD/CVE Database
• MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySimilar attack · NVD/CVE Database
• MediumCVE-2026-108574: BerriAI LiteLLM authorization bypass in session spend log view via session_idSimilar attack · NVD/CVE Database
• MediumCVE-2026-108670: JeecgBoot missing authorization in AiragPromptsControllerSimilar attack · NVD/CVE Database
• MediumCVE-2026-108600: open-multi-agent link following flaw in file_write tool sandboxSimilar attack · NVD/CVE Database