IDEs & agents · OpenAI
Codex CLI
OpenAI’s open-source terminal coding agent.
2Advisories
1critical
1high
0medium
2026-04-14Latest
Timeline · advisories per quarter
12025 Q3
12026 Q2
Named in sources
Reported for Codex CLI
01. CVE-2025-61260: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration filesA vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex CLI 2026-04-14 02. CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logicDue to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. Codex CLI 2025-09-19
Codex CLI 2026-04-14 02. CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logicDue to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. Codex CLI 2025-09-19