CVE-2025-61260: OpenAI Codex CLI code execution via project-local configuration

CVE-2025-61260 · Severity: critical · CVSS 9.8 · Published 2026-04-14

OpenAI Codex CLI is a command-line tool that allows developers to use AI for coding tasks directly in their terminal. A security flaw allows attackers to hide malicious commands inside a project's configuration files. If a developer runs the 'codex' command within a compromised or malicious repository, these commands execute automatically without any warning, potentially allowing the attacker to steal data, access credentials, or take control of the developer's computer.

Technologies: OpenAI Codex CLI. Vendors: npm, OpenAI.

Quick answers

Is CVE-2025-61260 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-61260 being exploited in the wild.
How severe is CVE-2025-61260?
Critical severity, with a CVSS score of 9.8, published 14 April 2026.
Which products and versions are affected?
@openai/codex (npm) <= 0.23.0, SEMVER:introduced=0,last_affected=0.23.0; OpenAI Codex CLI <= 0.23.0, v0.23.0 and before.
Is there a fix for CVE-2025-61260?
A patch was published on 2025-08-20: OpenAI released version 0.23.0 to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-61260 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-61260?
Check whether you run @openai/codex (npm) or OpenAI Codex CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability (CWE-94) exists in OpenAI Codex CLI due to the insecure handling of project-local configuration files. The CLI automatically loads and parses '.env' and '.codex/config.toml' files from the current working directory without user confirmation. An attacker can use a '.env' file to redirect the 'CODEX_HOME' environment variable to the local repository, forcing the CLI to load a malicious 'config.toml'. This configuration file can contain 'mcp_servers' entries with arbitrary shell commands that are executed immediately upon CLI startup in the context of the local user. The vulnerability was patched in version 0.23.0 by preventing '.env' files from silently redirecting 'CODEX_HOME' into project directories.

Affected products

  • OpenAI Codex CLI v0.23.0 and before

Identifiers

  • CVE-2025-61260
  • GHSA-xrxf-jgv3-qmrm

Timeline

  • 2025-08-07: disclosed: Check Point Research disclosed the issue to OpenAI.
  • 2025-08-20: patched: OpenAI released version 0.23.0 to address the vulnerability.
  • 2026-04-14: advisory: CVE-2025-61260 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.