GHSA-jv2h-4p9v-wf5w: ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
- Identifier
- GHSA-jv2h-4p9v-wf5w
- Published
- Record updated
- Affected
- ouroboros-ai <= 0.42.0
- Fixed in
- 0.42.1
- released June 18, 2026, 1 day before disclosure
Summary
GHSA-jv2h-4p9v-wf5w affects ouroboros-ai, where the fix for CVE-2026-47211 in 0.39.0 left the `_UNTRUSTED_ENV_DENYLIST` incomplete. A malicious cloned repository can ship a `.env` that is auto-loaded at import and set keys such as `CODEX_HOME`, `OUROBOROS_MCP_CONFIG` and `OUROBOROS_ALLOW_LOCAL_TRANSPORT`, which lead to arbitrary command execution. The MCP bridge also auto-loaded `./.ouroboros/mcp_servers.yaml` from the working directory, so running `ooo` inside a malicious repo could spawn the committed server `command` without any `.env`.
Mitigation
Fixed in 0.42.1. All listed keys were added to `_UNTRUSTED_ENV_DENYLIST`, the cwd auto-discovery branch was removed, and the regression suite now derives from the source denylist. Workaround: do not run Ouroboros from an untrusted or cloned repository directory, and remove any project-directory `.env` and `./.ouroboros/mcp_servers.yaml` before running.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online