PYSEC-2026-2857 ouroboros-ai Vulnerable to Remote Code Execution via Untrusted Project-Directory .env

Impact A Remote Code Execution RCE vulnerability was discovered in Ouroboros. If a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code execution and potential system takeover. The vulnerability CWE-426: Untrusted Search Path & CWE-15...

PT-2026-45033

Name of the Vulnerable Software and Affected Versions Ouroboros versions prior to 0.39.0 Description A Remote Code Execution issue exists when the software loads a .env file from the current working directory. An attacker can include a malicious script in a repository and use environment variable...

abel (>=0.1.0 <=0.1.1), abel-core (>=0.1.0 <=0.1.1) +311 more potentially affected by unknown CVE via ouroboros (>=0.10.1 <=0.15.6)

ouroboros CARGO version =0.10.1, =0.1.0, =0.1.0, =0.4.0, =0.4.0, =0.4.0, =0.1.0, =1.1.0, =0.6.0, =0.1.0, =0.1.1, =0.3.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0042...