Arbitrary Code Execution Vulnerability in Ouroboros Runtime by Q00

CVE-2026-47211

What is CVE-2026-47211?

The Ouroboros Runtime, designed for AI coding agents, is susceptible to an arbitrary code execution vulnerability when operated with malicious repositories. If a user clones a compromised repository and executes commands in that directory, the runtime may inadvertently run malicious scripts due to improper handling of environment variable configurations from the local .env file. This can result in the execution of unintended commands, posing a severe risk of system compromise. It is recommended that users update to version 0.39.0 to safeguard against this vulnerability.

References