Inclusion of Functionality from Untrusted Control Sphere

Overview @openai/codex is a OpenAI Codex CLI Lightweight coding agent that runs in your terminal Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to auto-approving ripgrep execution even when the --pre, --hostname-bin, --search-zip, ...

@4via6/relay (>=1.0.0, <=1.1.3), @circleci/agents (>=1.0.6, <=2.3.1) +4 more potentially affected by CVE-2025-54558 via @openai/codex (>=0.1.2504211509, <=0.8.0)

@openai/codex NPM version =0.1.2504211509, =1.0.0, =1.0.6, =0.23.0, =1.0.0, =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2025-54558 Source advisory: SNYK:JS-OPENAICODEX-10945018...

CVE-2025-54558

OpenAI Codex CLI before 0.9.0 auto-approves ripgrep aka rg execution even with the --pre or --hostname-bin or --search-zip or -z flag...

CVE-2025-54558

OpenAI Codex CLI (prior to 0.9.0) is affected: the CLI auto-approves ripgrep (rg) execution even when --pre, --hostname-bin, --search-zip, or -z are used. This could enable unintended command execution via these flags. Remediation: upgrade to version 0.9.0 or later.

CVE-2025-54558

OpenAI Codex CLI before 0.9.0 auto-approves ripgrep aka rg execution even with the --pre or --hostname-bin or --search-zip or -z flag...

PT-2025-30717 · Openai +1 · Openai Codex Cli +1

Name of the Vulnerable Software and Affected Versions: OpenAI Codex CLI versions prior to 0.9.0 Description: The OpenAI Codex CLI application automatically approves the execution of ripgrep rg even when specific flags—--pre, --hostname-bin, --search-zip, or -z—are used. Recommendations: Update to...

OpenAI Codex CLI 安全漏洞

OpenAI Codex CLI is an OpenAI open source lightweight coding agent software that runs in the terminal. A security vulnerability exists in OpenAI Codex CLI versions prior to 0.9.0 that stems from automatic approval of ripgrep execution, which could lead to a security risk...

CVE-2025-54558: Inclusion of Functionality from Untrusted Control Sphere

OpenAI Codex CLI before 0.9.0 auto-approves ripgrep aka rg execution even with the --pre or --hostname-bin or --search-zip or -z flag...

CVE-2025-54558

OpenAI Codex CLI before 0.9.0 auto-approves ripgrep aka rg execution even with the --pre or --hostname-bin or --search-zip or -z flag...

CVE-2025-54558

OpenAI Codex CLI before 0.9.0 auto-approves ripgrep aka rg execution even with the --pre or --hostname-bin or --search-zip or -z flag...

ChatGPT: A tool for offensive cyber operations?! Not so fast!

ChatGPT: A tool for offensive cyber operations?! Not so fast! By Trellix · March 09, 2023 This story was also written by John Rodriguez. To ChatGPT or to not ChatGPT? That is a predominant question in the cyber landscape these days. It’s no surprise that AI bots have taken society by storm. On th...

ChatGPT: A tool for offensive cyber operations?! Not so fast!

ChatGPT: A tool for offensive cyber operations?! Not so fast! By Trellix · March 09, 2023 This story was also written by John Rodriguez. To ChatGPT or to not ChatGPT? That is a predominant question in the cyber landscape these days. It’s no surprise that AI bots have taken society by storm. On th...