What happened
Following the initial fix for CVE-2026-47211 (arbitrary code execution when running Ouroboros in a malicious repo directory), the vendor's denylist for execution-routing keys was found incomplete, and CVE-2026-66065 (CVSS 8.4) was published 2026-08-03 documenting that the same RCE class remained exploitable via repo-planted files.
Why it matters
Ouroboros is a popular (~5,200 GitHub stars) local-first runtime specifically designed to record and police AI coding-agent behavior; an RCE that triggers merely from cloning and running commands in a malicious repo defeats the tool's entire security value proposition and directly threatens developers running AI coding agents on untrusted codebases.
Attack vector
Ouroboros records and constrains AI coding-agent actions via a policy/denylist. Several execution-routing keys within the same RCE class as the original flaw (CVE-2026-47211) were omitted from the denylist, so simply cloning a malicious repository and running Ouroboros commands inside that directory can still achieve arbitrary code execution, even after the initial fix.
Affected systems
Ouroboros (Q00/ouroboros) < 0.42.1 (companion issue to CVE-2026-47211, < 0.39.0)
Mitigation
Upgrade to Ouroboros 0.42.1 or later (supersedes the incomplete 0.39.0 fix for CVE-2026-47211). Avoid running Ouroboros commands inside untrusted/cloned repositories until patched.