ouroboros-ai has 3 CVEs on record.

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 0% vs 1% corpus
Median CVSS: —
Publish → KEV: —
Last 90 days: 0 prev 3

Weakness classes

Products

ouroboros-ai 3

Follow ouroboros-ai:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

CVE-2026-47211HighOuroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior41
GHSA-jv2h-4p9v-wf5wHighouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys41
CVE-2026-66065Highouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys41

ouroboros-ai vulnerabilities

CVEs affecting ouroboros-ai, newest first. Open any entry for full detail, references, and exploit status.

3 CVEsRSS

CVE-2026-47211High

3mo ago

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands …

▾ Twilightouroboros-ai · ouroboros-aiEPSS 0.19%via NVD

CVE-2026-66065High

4mo ago

ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

▾ Twilightouroboros-ai · ouroboros-aiEPSS 0.24%via OSV

GHSA-jv2h-4p9v-wf5wHigh

4mo ago

ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

▾ Twilightouroboros-ai · ouroboros-aivia GHSA