CVE-2026-66065 is a high-severity vulnerability in Ouroboros, a local-first runtime for AI coding agents. The issue arises from an incomplete denylist in versions prior to 0.42.1, allowing for arbitrary command execution via a malicious cloned repository. This vulnerability enables attackers to execute commands by shipping a .env file, bypassing approval gates through backend config-home and MCP/plugin ro [truncated]
CVE-2026-47211 is a high-severity vulnerability in Ouroboros, a local-first runtime for AI coding agents. If a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code execution and potential system takeover. The vulnerability stems from Ouroboros loading the .env file from the current working directory, allowing an attacker to include a malicious [truncated]
