EUVD-2026-54862
GHSA-5pgh-4pr5-mhm8
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack vector and low privileges required to invoke the MCP tool; limited and equal C/I/A impact consistent with user-space command injection with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in andreahaku codex_mcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/codex-process-simple.ts of the component ask MCP Tool. The manipulation of the argument model results in command injection. The attack requires a local approach. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Command injection in andreahaku/codex_mcp's ask MCP Tool allows a low-privileged local attacker to execute arbitrary OS commands by supplying shell metacharacters in the model argument passed unsanitized to a system call in src/codex-process-simple.ts. The project uses no versioning, meaning all deployments up to commit 1ff521cc are affected with no safe version to target for upgrade. A proof-of-concept exists per the CVSS 4.0 E:P supplemental metric, and the maintainer has not responded to the disclosed issue, leaving no vendor-released patch available.
Technical ContextAI
codex_mcp is a TypeScript-based Model Context Protocol (MCP) server exposing an ask tool, with the vulnerable logic residing in src/codex-process-simple.ts. CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection) identifies the root cause: the model argument supplied to the ask MCP Tool is passed to a shell or child-process invocation without sanitization or allowlisting. Shell metacharacters such as semicolons, pipes, backticks, or command substitution sequences (e.g., $(id)) can break out of the intended command context. CPE cpe:2.3:a:andreahaku:codex_mcp:*:*:*:*:*:*:*:* confirms the affected product with a wildcard version, consistent with the project's lack of semantic versioning. MCP tools are increasingly used as AI agent infrastructure, meaning this class of injection flaw can have downstream consequences in agentic pipelines if the server is invoked with attacker-influenced inputs.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the GitHub issue report (https://github.com/andreahaku/codex_mcp/issues/1). The primary mitigation is to avoid deploying this MCP server in any environment where untrusted or low-privileged local users can invoke the ask tool with attacker-controlled model values. Organizations requiring this functionality should fork the repository and apply input validation in src/codex-process-simple.ts - specifically, either strict allowlisting of accepted model values against a known-safe set, or replacement of shell-based invocation with a direct API call that avoids shell interpretation entirely; the trade-off of the allowlist approach is reduced flexibility if new model names need to be added. Restricting OS-level execution of the MCP server to a dedicated service account that is inaccessible to general users provides an additional defense-in-depth layer. Monitor https://github.com/andreahaku/codex_mcp for any upstream fix commits.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today