2025-08 · 2025-Q3
OpenAI Codex CLI Command Injection
Primary layerL5 Config
Who wrote the file that runs on open?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
OpenAI Codex CLI (before v0.23.0)
Impact
Arbitrary command execution in user's security context; CI/automation runs at risk
Root cause
Codex implicitly trusted project-local config files and executed embedded commands
CVE
Sources
Catalog
Cite this: AgentProv incident record: OpenAI Codex CLI Command Injection (2025-08). https://agentprov.com/incidents/2025-08-openai-codex-cli-command-injection
Related
- Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
- Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
- Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config