92 matches found
@4via6/relay (>=1.0.0, <=1.1.3), @circleci/agents (>=1.0.6, <=2.3.1) +6 more potentially affected by CVE-2025-61260 via @openai/codex (>=0.1.2504211509, <=0.20.0)
@openai/codex NPM version =0.1.2504211509, =1.0.0, =1.0.6, =0.0.1, =0.23.0, =1.0.0, =0.0.1, =0.1.0, =1.0.0, =1.0.2 Source cves: CVE-2025-61260 Source advisory: OSV:GHSA-XRXF-JGV3-QMRM...
OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files
A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP Model Context Protocol configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads...
GHSA-XRXF-JGV3-QMRM OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files
A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP Model Context Protocol configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads...
CVE-2025-61260
A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP Model Context Protocol configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads...
CVE-2025-61260: Improper Control of Generation of Code
A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP Model Context Protocol configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads...
OpenAI Codex CLI 安全漏洞
OpenAI Codex CLI is a lightweight coding agent software developed by OpenAI and run in the terminal. OpenAI Codex CLI versions prior to v0.23.0 have security vulnerabilities; these vulnerabilities stem from automatically loading malicious MCP configuration files, which may allow arbitrary code to...
CVE-2025-61260
A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP Model Context Protocol configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads...
CVE-2025-61260
A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP Model Context Protocol configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads...
CVE-2025-61260
A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP Model Context Protocol configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads...
CVE-2025-61260
A code execution vulnerability exists in OpenAI Codex CLI v0.23.0 and prior versions. The flaw allows for arbitrary command execution because the tool automatically loads project-local .env and .codex/config.toml files without user confirmation. An attacker can trigger this by tricking a user int...
PT-2026-29445
@jxnlco @emilyzsh I think he is referring to that recent CVE-2026-4417 — OpenAI Codex vulnerability where excessive usefulness leads to immediate $200/month spend escalation. No patch available; users report “this is actually worth it” before wallet compromise...
OpenAI Codex Vulnerability Allowed Attackers to Steal GitHub Tokens
OpenAI Codex vulnerability allowed attackers to steal GitHub tokens via malicious branch names using hidden Unicode command injection flaw...
OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues
OpenAI on Friday began rolling out Codex Security , an artificial intelligence AI-powered security agent that's designed to find, validate, and propose fixes for vulnerabilities. The feature is available in a research preview to ChatGPT Pro, Enterprise, Business, and Edu customers via the Codex w...
Exploit for CVE-2025-59532
CVE-2025-59532 Docker Environment A Docker-based research env...
Exploit for CVE-2025-61260
OpenAI Codex CLI Vuln...
PT-2025-48450
Name of the Vulnerable Software and Affected Versions OpenAI Codex CLI versions prior to 0.23.0 Description The OpenAI Codex CLI is susceptible to a command injection flaw stemming from how it processes project-local configuration files. Attackers can exploit this by placing malicious configurati...
EUVD-2025-22560
Malicious code in bioql PyPI...
@circleci/agents (>=1.0.6, <=2.10.0), @digipair/skill-codex (>=0.99.1, <=0.143.0) +3 more potentially affected by CVE-2025-59532 via @openai/codex (>=0.8.0, <=0.29.0)
@openai/codex NPM version =0.8.0, =1.0.6, =0.99.1, =0.0.1, =0.1.0, =0.99.1, =0.143.0 Source cves: CVE-2025-59532 Source advisory: OSV:GHSA-W5FX-FH39-J5RW...
