{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-61260", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-16T12:06:45.207Z", "dateReserved": "2025-09-26T00:00:00.000Z", "datePublished": "2026-04-14T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-14T14:14:32.518Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and .codex/config.toml files without requiring user confirmation, allowing attackers to embed arbitrary commands that execute immediately."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "http://openai.com"}, {"url": "https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "references": [{"url": "https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T11:31:28.540098Z", "id": "CVE-2025-61260", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:06:45.207Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-61260", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-16T11:31:28.540098Z"}}}], "references": [{"url": "https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T11:30:46.241Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "http://openai.com"}, {"url": "https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/"}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and .codex/config.toml files without requiring user confirmation, allowing attackers to embed arbitrary commands that execute immediately."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-14T14:14:32.518Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61260", "state": "PUBLISHED", "dateUpdated": "2026-04-16T12:06:45.207Z", "dateReserved": "2025-09-26T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-14T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and .codex/config.toml files without requiring user confirmation, allowing attackers to embed arbitrary commands that execute immediately."}], "id": "CVE-2025-61260", "lastModified": "2026-04-17T15:24:57.753", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-04-14T15:16:24.487", "references": [{"source": "cve@mitre.org", "url": "http://openai.com"}, {"source": "cve@mitre.org", "url": "https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.23.0]"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 86.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "codex", "vendor": "openai"}], "analysis": {"en": {"generated_at": "2026-04-17T11:26:38.427549+00:00", "value": {"mitigation_remediation": ["Apply any available OpenAI Codex CLI update that resolves this issue.", "Avoid running codex commands in untrusted or potentially compromised repositories.", "Manually inspect and remove or sanitize any .env or .codex/config.toml files before invoking the CLI."], "summary": {"action": "Patch urgently", "impact": "Arbitrary code execution via CLI configuration"}, "threat_synthesis": {"affected_systems": "The affected product is the OpenAI Codex Command Line Interface version 0.23.0 and any earlier release. The issue is triggered in any repository that contains a .env file or a .codex/config.toml file designed by an attacker. The CLI processes these files automatically whenever a codex command is executed within that repository, regardless of the repository\u2019s provenance.", "description_and_impact": "The vulnerability arises when the OpenAI Codex CLI automatically loads project\u2011local configuration files without user confirmation. Malicious content placed in .env or .codex/config.toml can be executed immediately, giving an attacker the ability to run arbitrary commands on the host where the CLI is invoked. This flaw represents a command\u2011injection style weakness that directly compromises confidentiality, integrity, and availability of the local system.", "risk_and_exploitability": "The CVSS score is 9.8, and the EPSS metric is < 1\u202f%; the vulnerability is not listed in the CISA KEV catalog. However, the attack requires only that the user runs a codex command in a repository that can be influenced by an attacker, which is a realistic scenario in collaborative or publicly hosted projects. Because the vulnerability allows local execution of arbitrary code, the risk can be considered high, especially in environments where the CLI is used frequently or where repository content is not strictly trusted."}}}}, "created": "2026-04-14T16:16:53.635189+00:00", "title": "OpenAI Codex CLI Command Injection via Malicious Configuration Files", "updated": "2026-04-17T11:30:16.992421+00:00", "vendors": ["openai", "openai$PRODUCT$codex"]}