What is the CVSS score of EUVD-2025-209435?

EUVD-2025-209435 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of OpenAI Codex CLI are affected by EUVD-2025-209435?

OpenAI Codex CLI v0.23.0 and earlier contains a critical vulnerability enabling arbitrary code execution when developers invoke the tool in repositories containing malicious .env or…

How to fix or mitigate EUVD-2025-209435?

Within 24 hours, inventory all systems running OpenAI Codex CLI v0.23.0 or earlier and identify which repositories developers have recently accessed; issue immediate guidance prohibiting tool use in untrusted or external repositories without pre-execution code review of .env and .codex/config.toml files. Within 7 days, either disable the tool enterprise-wide or implement configuration controls to prevent automatic loading of local configuration files; conduct forensic scans of development machines for unauthorized process execution or credential compromise. Within 30 days, continuously monitor OpenAI security advisories for vendor patch release; deploy automated controls preventing local .env and .codex/config.toml loading; provide targeted security training to development teams on supply chain compromise vectors.

OpenAI Codex CLI EUVD-2025-209435

| CVE-2025-61260 CRITICAL

Code Injection (CWE-94)

2026-04-14 mitre

GHSA-xrxf-jgv3-qmrm

RCE Code Injection N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Attack is local via a malicious repo (AV:L) and needs the victim to run codex in it (UI:R); no attacker auth (PR:N); full host code execution yields C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:44 vuln.today

CVSS changed

Apr 16, 2026 - 13:22 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 14, 2026 - 14:30 euvd

EUVD-2025-209435

CVE Published

Apr 14, 2026 - 00:00 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on @openai/codex (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.23.0.

DescriptionCVE.org

A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and .codex/config.toml files without requiring user confirmation, allowing attackers to embed arbitrary commands that execute immediately.

AnalysisAI

Arbitrary code execution in OpenAI Codex CLI v0.23.0 and earlier occurs because the tool automatically loads project-local .env and .codex/config.toml (MCP configuration) files without any user confirmation when a developer runs the codex command inside a repository. An attacker who controls or poisons a repository can embed commands that execute immediately on the victim's machine when Codex is invoked there. Publicly available exploit code exists (SSVC 'poc') and Check Point Research published a technical write-up, but the flaw is not on CISA KEV and EPSS is very low (0.02%), indicating no evidence of widespread active exploitation.

Technical ContextAI

The affected component is OpenAI's Codex CLI, an AI coding agent that integrates with the Model Context Protocol (MCP) to configure external tools and servers. Codex reads project-scoped configuration - a .env file and .codex/config.toml - from the current working directory at startup. The root cause is CWE-94 (Improper Control of Generation of Code / code injection): trusted-by-default parsing of attacker-influenceable configuration allows commands specified in those files (e.g., MCP server launch directives) to be executed without validation or an explicit user trust prompt. CPE data is not meaningfully populated (cpe:2.3:a:n/a:n/a), so the exact product identity relies on the CVE description rather than NVD CPE.

RemediationAI

Upgrade OpenAI Codex CLI to a release later than v0.23.0 that no longer auto-loads project-local .env and .codex/config.toml files without confirmation; an exact fixed version is not stated in the provided data, so released patched version is not independently confirmed - verify the current version against openai.com and the Check Point advisory before deploying. Until upgraded, do not run codex inside untrusted, cloned, or third-party repositories; treat repositories the same as untrusted code before execution. As specific compensating controls: inspect any .codex/config.toml and .env files for command/MCP-server directives before invoking Codex in an unfamiliar repo (trade-off: manual and easy to forget); run Codex only inside a sandboxed container or disposable VM with no host credentials mounted (trade-off: added workflow friction); and remove or relocate project-local Codex config so only a vetted user-level config is used (trade-off: loses legitimate per-project MCP configuration). Consult https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/ for technical detail.