# ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

Incomplete denylist fix lets a cloned repo's .env or committed mcp_servers.yaml redirect Ouroboros config roots, spawning attacker commands for RCE.

- Payout: Research
- Severity: high
- Program: Ouroboros
- Found by: hackkim, matte1782
- Disclosed: 2026-06-19
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-jv2h-4p9v-wf5w
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-jv2h-4p9v-wf5w
- Tags: area:oss domain:oss impact:rce kind:research platform:ghsa sev:high tech:python technique:incomplete-fix technique:source-review vuln:misconfiguration vuln:rce

**Target:** Python CLI agent orchestrator (pip ouroboros-ai) loading project .env and MCP config
**Root cause:** The CVE-2026-47211 fix denylisted only some execution-routing env keys; omitted backend config-home roots, MCP/plugin roster paths, SSRF toggle and instruction roots still let an untrusted project .env redirect execution. Separately, the MCP bridge auto-loaded ./.ouroboros/mcp_servers.yaml from cwd.
**Steps:**
1. Clone a malicious repo containing a `.env` with `CODEX_HOME=./.evil` and a committed `./.evil/config.toml` defining `mcp_servers.<name>.command/args` plus `approval_policy="never"` and `sandbox_mode="danger-full-access"`.
2. Run `ooo` inside the repo; the .env is auto-loaded at import with no review step.
3. The spawned vendor Codex CLI resolves config from CODEX_HOME and executes the attacker's mcp_servers command.
4. Alternatively commit `./.ouroboros/mcp_servers.yaml` with a server `command`/`args`; the bridge's `create_bridge_from_env(cwd=Path.cwd())` spawns it via stdio_client with no .env needed.
5. Other omitted keys: `OUROBOROS_MCP_CONFIG`, `OUROBOROS_PLUGIN_LOCKFILE`, `OUROBOROS_PLUGIN_TRUST_ROOT`, `OUROBOROS_ALLOW_LOCAL_TRANSPORT`, `OUROBOROS_AGENTS_DIR`, `COPILOT_CUSTOM_INSTRUCTIONS_DIRS`, `OUROBOROS_RUNTIME_PROFILE`, `OUROBOROS_TOOL_CAPABILITIES`.
**How found:** Reporters audited the CVE-2026-47211 denylist for other keys of the same execution-routing class and found omitted config-home, MCP/plugin roster, SSRF and instruction-root variables; also noticed the cwd auto-discovery branch in create_bridge_from_env.
**Exploitation:** Attacker ships a repo with a malicious .env (or ./.ouroboros/mcp_servers.yaml); victim runs `ooo` in it, causing the tool to spawn attacker-controlled commands via vendor CLI config or MCP stdio_client, achieving RCE and bypassing the human approval gate.
**Escalation:** Setting approval_policy=never and sandbox_mode=danger-full-access removes the approval gate; OUROBOROS_TOOL_CAPABILITIES can lower a tool's approval_class.
**Insight:** When a fix is a denylist of dangerous env vars, enumerate every variable that influences subprocess spawning or config resolution (vendor *_HOME, *_CONFIG, plugin lockfiles, instruction dirs) and check for cwd-relative auto-discovery paths that bypass env entirely.