CVE-2025-61260

CRITICAL EPSS 93.4%

Published Apr 14, 20262mo ago · Modified Jun 17, 20261w ago

9.8 CVSS 3.1

Critical

Published Apr 14, 2026 2mo ago

Last Modified Jun 17, 2026 1w ago

Description

A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and .codex/config.toml files without requiring user confirmation, allowing attackers to embed arbitrary commands that execute immediately.

CVSS Details

Base Score

9.8

Exploitability

3.9

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

93.4% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-94 Improper Control of Generation of Code (Code Injection) Injection

References 2

openai.com http://openai.com
research.checkpoint.com https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.