Skip to content
OpenAdvisories

Package · npm

@openai/codex

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.8
    CVE-2025-61260

    OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files

    A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised …

    @openai/codex npm
  • High 8.6
    CVE-2025-59532 Public exploit

    Codex has sandbox bypass due to bug in path configuration logic

    Codex CLI is a coding agent from OpenAI that runs locally. In versions 0.2.0 to 0.38.0, due to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where th…

    OpenAI codex @openai/codex npm