ouroboros-ai has 3 CVEs on record. 1 was published in the last 90 days.

CVEs per month

Last 12 months, by publish date

1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09

Exploited share: 0% vs 1% corpus
Median CVSS: —
Publish → KEV: —
Last 90 days: 1 prev 2

Weakness classes

Products

ouroboros-ai 3

Follow ouroboros-ai:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

CVE-2026-47211HighOuroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior41
GHSA-jv2h-4p9v-wf5wHighouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys41
CVE-2026-66065Highouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys41

ouroboros-ai vulnerabilities

CVEs affecting ouroboros-ai, newest first. Open any entry for full detail, references, and exploit status.

3 CVEsRSS

CVE-2026-47211High

1mo ago

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands …

▾ Twilightouroboros-ai · ouroboros-aiEPSS 0.17%via NVD

CVE-2026-66065High

3mo ago

ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

▾ Twilightouroboros-ai · ouroboros-aiEPSS 0.30%via OSV

GHSA-jv2h-4p9v-wf5wHigh

3mo ago

ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

▾ Twilightouroboros-ai · ouroboros-aivia GHSA