OpenAI Codex CLI Command Injection Vulnerability Lets Attackers Execute Arbitrary Commands

A critical command injection vulnerability discovered in OpenAI’s Codex CLI tool allows attackers to execute arbitrary commands on developer machines without any user interaction or approval.

Security researchers Isabel Mill and Oded Vanunu uncovered the flaw, tracked as CVE-2025-61260, on December 1, 2025.

The Vulnerability Details

The Codex CLI, designed to bring AI-powered reasoning into developer workflows through a command-line interface, contains a severe security flaw in how it handles project-local configuration files.

The vulnerability has been assigned a CVSS score of 9.8, indicating critical severity.

The core issue lies in the tool’s automatic loading and execution of Model Context Protocol (MCP) server entries from a project’s local configuration.

When developers run Codex inside a repository, the tool silently executes these configuration entries without any interactive approval, secondary validation, or rechecks when values change.

How the Attack Works

Exploiting this vulnerability requires minimal effort from an attacker. An attacker with write access or pull request permissions to a repository can add two simple files to launch the attack.

First, they create a .env file that redirects the Codex configuration directory to a local folder using the command CODEX_HOME=./.codex. Second, they create a ./.codex/config.toml file containing malicious MCP server entries with arbitrary shell commands.

When a developer clones the repository and runs Codex, the tool automatically executes these embedded commands in the developer’s system context without any warnings or prompts.

checkpoint researchers demonstrated this vulnerability with multiple proof-of-concept payloads, including deterministic file-creation attacks and reverse-shell execution, all running silently on victim machines.

The vulnerability enables several dangerous attack scenarios that pose significant risks to developers and organizations.

Attackers can achieve persistent remote access by embedding reverse shells in the configuration file, granting entry every time a developer runs Codex. They gain full access to the developer’s system and credentials.

Developer machines typically contain highly sensitive assets including cloud authentication tokens, SSH keys, source code repositories, and access credentials.

Attackers can directly harvest these secrets, compromising entire development environments.

A particularly insidious attack vector involves initially benign configurations that are later replaced with malicious commands after code has been merged.

This creates a stealthy, post-approval backdoor that evades traditional security review processes.

The compromise extends beyond individual developers. If continuous integration systems, automation tools, or build agents run Codex against checked-out code, the vulnerability propagates into build artifacts and downstream deployments.

Contaminated templates or popular open-source projects can weaponize numerous downstream consumers with a single malicious commit.

This flaw fundamentally breaks the security boundary developers expect from their tools. Project-supplied files, which developers naturally trust as legitimate repository components, become trusted execution material without any validation or security checks.

An attacker needs only repository write access or a successful pull request merge to trigger silent code execution on any developer who pulls the changes and runs Codex.

The vulnerability creates an exceptionally effective supply-chain attack vector because it integrates seamlessly into everyday developer workflows, making detection extremely difficult.

Unlike security flaws requiring multiple steps or explicit user interaction, this vulnerability operates silently. Developers have no indication that arbitrary commands are executing when they run what appears to be a routine development tool.

OpenAI has been notified of the vulnerability. Developers should immediately review their use of the Codex CLI and audit project configurations for suspicious MCP server entries.

Organizations should monitor their repositories for unauthorized configuration changes until a patched version becomes available.

The discovery underscores the critical importance of validating tool configurations and implementing strict access controls on repository permissions, particularly for development tools with system-level execution capabilities.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates