Executive brief
OpenAI Codex CLI is a command-line tool that allows developers to use AI for coding tasks directly in their terminal. A security flaw allows attackers to hide malicious commands inside a project's configuration files. If a developer runs the 'codex' command within a compromised or malicious repository, these commands execute automatically without any warning, potentially allowing the attacker to steal data, access credentials, or take control of the developer's computer.
Technical details
A code injection vulnerability (CWE-94) exists in OpenAI Codex CLI due to the insecure handling of project-local configuration files. The CLI automatically loads and parses '.env' and '.codex/config.toml' files from the current working directory without user confirmation. An attacker can use a '.env' file to redirect the 'CODEX_HOME' environment variable to the local repository, forcing the CLI to load a malicious 'config.toml'. This configuration file can contain 'mcp_servers' entries with arbitrary shell commands that are executed immediately upon CLI startup in the context of the local user. The vulnerability was patched in version 0.23.0 by preventing '.env' files from silently redirecting 'CODEX_HOME' into project directories.
Affected products
- OpenAI Codex CLI v0.23.0 and before
Timeline
- 2025-08-07: disclosed: Check Point Research disclosed the issue to OpenAI.
- 2025-08-20: patched: OpenAI released version 0.23.0 to address the vulnerability.
- 2026-04-14: advisory: CVE-2025-61260 published.