Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-47211

Vulnerability in ouroboros-ai (CVE-2026-47211)

Summary

Vulnerability in ouroboros-ai (CVE-2026-47211). Risk of unauthorized operations or information disclosure. Exploitable via OUROBOROS_CLI_PATH. Mitigation: upgrade to 0.39.0 or later.

Original description

The description as published by the source.

Impact

A Remote Code Execution (RCE) vulnerability was discovered in Ouroboros. If a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code execution and potential system takeover.

The vulnerability (CWE-426: Untrusted Search Path & CWE-15: External Control of System Setting) stems from Ouroboros loading the .env file from the current working directory. Prior to the patch, execution-affecting environment variables such as OUROBOROS_CLI_PATH, OPENCODE_CLI_PATH, and other backend selectors were accepted directly from this local .env. An attacker could include a malicious script in the repository and point the CLI path variable to it (e.g., OUROBOROS_CLI_PATH=./malicious_script.sh). When the user executes a command like ouroboros init or any command that instantiates the adapter, the malicious script is executed instead of the intended CLI.

Patches

The vulnerability has been patched in version 0.39.0 via PR #1078.
The fix establishes a strict trust boundary by applying a denylist to project-local .env loading. It blocks execution-affecting environment variables (such as runtime selectors and CLI path overrides) from being loaded from the project directory. Explicit constructor overrides and trusted user-owned home configurations (~/.ouroboros/.env) remain fully functional.

Users are strongly advised to upgrade to version 0.39.0 or later.

Workarounds

If upgrading is not immediately possi…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-47211 has been found in ouroboros-ai.
Attackers can target a specific entry point like OUROBOROS_CLI_PATH over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade ouroboros-ai to 0.39.0 or later.
If unsure, ask your IT team or search "ouroboros-ai CVE-2026-47211" on the vendor's site.

CVE-2026-47211 (ouroboros-ai) — CWE-426
Attack surface: OUROBOROS_CLI_PATH / OPENCODE_CLI_PATH
Patched: 0.39.0 — apply immediately
Workaround: If upgrading is not immediately possible, users must carefully inspect any .env file inside cloned repositories before running Ouroboros commands to ensure it does not contain unexpected OUROBOROS_*_CLI_PATH or OPENCODE_CLI_PATH overrides.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-426) exists in ouroboros-ai. Attackers reach the vulnerable code path via OUROBOROS_CLI_PATH.

📍 Affected scope

Check the vendor advisory for the affected versions of ouroboros-ai. Attack surface: OUROBOROS_CLI_PATH / OPENCODE_CLI_PATH.

🔥 Severity

Severity: ?. Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 0.39.0.

🛡️ Workaround

Workaround: If upgrading is not immediately possible, users must carefully inspect any .env file inside cloned repositories before running Ouroboros commands to ensure it does not contain unexpected OUROBOROS_*_CLI_PATH or OPENCODE_CLI_PATH overrides.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'ouroboros-ai' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'ouroboros-ai' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で ouroboros-ai を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply temporary workaround mitigate 
    If upgrading is not immediately possible, users must carefully inspect any `.env` file inside cloned repositories before running Ouroboros commands to ensure it does not contain unexpected `OUROBOROS_*_CLI_PATH` or `OPENCODE_CLI_PATH` overrides.

    パッチが適用されるまでの応急処置として、If upgrading is not immediately possible, users must carefully inspect any .env file inside cloned repositories before running Ouroboros commands to ensure it does not contain unexpected OUROBOROS_*_CLI_PATH or OPENCODE_CLI_PATH overrides. を実施。回避策の副作用 (機能低下) を確認した上で。

  3. 3
    Apply patch patch 
    Upgrade ouroboros-ai to 0.39.0

    ステージング環境で 0.39.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  4. 4
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

pip ouroboros-ai
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.39.0"}]}]
PyPI ouroboros-ai
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.39.0"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details