Codex Mcp
Monthly
Command injection in andreahaku/codex_mcp's `ask` MCP Tool allows a low-privileged local attacker to execute arbitrary OS commands by supplying shell metacharacters in the `model` argument passed unsanitized to a system call in src/codex-process-simple.ts. The project uses no versioning, meaning all deployments up to commit 1ff521cc are affected with no safe version to target for upgrade. A proof-of-concept exists per the CVSS 4.0 E:P supplemental metric, and the maintainer has not responded to the disclosed issue, leaving no vendor-released patch available.
Command injection in andreahaku/codex_mcp's `ask` MCP Tool allows a low-privileged local attacker to execute arbitrary OS commands by supplying shell metacharacters in the `model` argument passed unsanitized to a system call in src/codex-process-simple.ts. The project uses no versioning, meaning all deployments up to commit 1ff521cc are affected with no safe version to target for upgrade. A proof-of-concept exists per the CVSS 4.0 E:P supplemental metric, and the maintainer has not responded to the disclosed issue, leaving no vendor-released patch available.