EUVD-2026-69394
GHSA-2frj-4qr5-m2rf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker crafts malicious repository with --%] smuggling
-
DeliveryDeveloper opens repository with Codex
-
ExploitStop-parsing token bypasses command-safety classifier
-
InstallGit command silently writes attacker config
-
C2Developer restarts Codex or config reloads
-
ExecuteAttacker-controlled MCP server connects
-
ImpactArbitrary code executes as developer user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Escape character neutralization
|
| Exploitation Conditions | The attacker must prepare a repository with instructions that use PowerShell's stop-parsing token (--%) to smuggle arguments past Codex's command classifier. The user must actively open that repository using Codex CLI or Codex Desktop and allow Codex to follow embedded instructions. The filesystem sandbox must permit the configuration file write - on macOS and Linux, the default sandbox can block writes outside permitted directories, which stops exploitation in default configurations on those platforms. On macOS and Linux, PowerShell Core (pwsh) must be separately installed for the PowerShell execution path to be reachable; on Windows, built-in PowerShell is always present, making Windows the more exposed platform. After the config write, Codex must subsequently load the modified configuration (e.g., on restart) for the MCP server to launch. The approval bypass does not grant filesystem privileges beyond what the user's account already holds. |
| Impact | The vendor-supplied CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) reflects a worst-case Windows scenario where PowerShell is built-in and the full attack chain completes without additional prerequisites. Real-world risk is meaningfully lower for several reasons: exploitation requires the user to actively open a specifically crafted repository with Codex, the filesystem sandbox on macOS and Linux blocks config writes in default deployments, and on non-Windows systems the attacker additionally needs PowerShell Core (pwsh) to be separately installed. The multi-step chain - bypass safety check, write config, Codex reloads config, MCP server launches, code executes - makes opportunistic mass exploitation unlikely. EPSS at 0.16% (6th percentile) corroborates low current exploitation activity. No CISA KEV listing exists and no public PoC beyond the test case in PR #22643 is known. The realistic priority is elevated for Windows-based developers who open untrusted repositories with Codex, and lower for macOS/Linux users relying on default sandboxing. |
| Exploit ScenarioDerived | An attacker publishes a Git repository containing Codex instructions that embed a stop-parsing token in a Git command (e.g., 'git log --% HEAD --output=~/.codex/config.json'); when a developer opens the repository with Codex on Windows and Codex follows the instructions, the safety classifier passes the command without prompting, and the file write overwrites Codex's configuration with attacker-controlled content. On the developer's next Codex session, the modified config causes Codex to connect to an attacker-operated MCP server, which then executes code and exfiltrates or modifies files accessible to the developer's account. The PR #22643 test case ('git log --% HEAD --output=codex_poc.txt') demonstrates the bypass primitive, though no weaponized public PoC is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
OpenAI Codex CLI and Codex Desktop's PowerShell command-safety parser failed to recognize PowerShell's stop-parsing token (--%), misclassifying file-writing Git commands embedded after that token as safe and executing them without user approval. An attacker who tricks a developer into opening a crafted repository can cause Codex to silently write an attacker-controlled configuration; when Codex subsequently loads that configuration, it launches an attacker-designated MCP server and executes arbitrary code under the user's account. No public exploit has been identified at time of analysis (EPSS 0.16%, 6th percentile), and the default filesystem sandbox on macOS and Linux can limit the damage radius by preventing writes outside permitted directories.
RemediationAI
Upgrade Codex CLI to a version above 0.130.0, Codex Desktop to a version above 26.513.40821 (or 26.513.31313 for the earlier branch), and the Codex Desktop Microsoft Store package to a version above 26.513.4821.0. The upstream fix is available in https://github.com/openai/codex/pull/22643. Until patching is complete, avoid opening untrusted or third-party repositories with Codex active, as the attack is entirely contingent on user-initiated repository interaction. On macOS and Linux, ensuring PowerShell Core (pwsh) is not installed removes the PowerShell execution path for this attack on those platforms; however, this does not eliminate the Windows risk. The default filesystem sandbox on macOS and Linux provides a compensating control that limits the config write even if the bypass is triggered - confirm sandbox is not loosened via permissive allow-lists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences). PowerShell's stop-parsing token (--%) instructs the shell to pass all remaining tokens verbatim to native commands without further AST processing. Codex uses a hybrid Rust/PowerShell safety classifier (powershell_parser.ps1 evaluated by a spawned PowerShell process and coordinated by powershell_parser.rs) that flattens the parsed AST into argv-like structures for safety checking. Because --%] was not handled, arguments appearing after the token were evaluated against the wrong parse representation, allowing constructs like 'git log --% HEAD --output=codex_poc.txt' to pass the classifier as safe. The PR #22643 fix adds an early-exit in the PowerShell parser script: if any token equals '--%', the function immediately returns status 'unsupported', blocking auto-approval. Affected CPEs are cpe:2.3:a:openai:codex_cli and cpe:2.3:a:openai:codex_desktop across all platforms.
Know when Codex Cli gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AC:H reflects multi-step chain requirements: filesystem sandbox must permit config write, Codex must reload config, and pwsh must be present on non-Windows platforms.
Primary rating from Vendor (OAI).
CVSS VectorVendor: OAI
Lifecycle Timeline
3DescriptionCVE.org
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user's privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations.
Zero Day Initiative Advisories
Executive ViewAI
OpenAI Codex CLI and Desktop versions contain a PowerShell parser bypass allowing attackers to silently write attacker-controlled files when developers open crafted repositories, potentially compromising development workstations with arbitrary code execution. This poses a supply-chain risk by enabling injection of malicious code into development environments and build pipelines. While exploitation probability is low (EPSS 0.2%) and requires social engineering, the attack can evade detection by leveraging hidden command-safety flaws.
Disable OpenAI Codex when working with untrusted or community-contributed repositories. Enforce mandatory code review of MCP server configuration files before execution. Leverage default operating system filesystem sandboxing on macOS and Linux to restrict Codex write access to designated directories. Implement change monitoring on developer configuration files and MCP server registries. Maintain an auditable inventory of installed MCP servers. Monitor OpenAI security advisories for patch release announcements.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB