AdvisoriesToolsStatsChecklistSubmitGet the email
← All tools
IDEs & agents · OpenAI

Codex CLI

OpenAI’s open-source terminal coding agent.

3Advisories
2critical
1high
0medium
2026-09-25Latest
Timeline · advisories per quarter
12025 Q3
12026 Q2
12026 Q3
Named in sources

Reported for Codex CLI

01. criticalCode executionCVE-2025-61260: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration filesA vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex CLI 2026-04-14 02. highBroken access controlCVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logicDue to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. Codex CLI 2025-09-19
Same pattern

Also worth checking

01. criticalBroken access controlUpGuard: 16,326 Supabase databases had readable tablesUpGuard checked about 300,000 websites that use Supabase and found 16,326 databases with tables anyone could read. Over half showed signs of personal data, and a smaller share held passwords or auth tokens. Supabase Claude Code Codex CLI +4 more 2026-09-25
The weekly email

One email a week. Only what changed.

New advisories, CVEs and fixes for Lovable, Bolt, v0, Replit, Base44 and Cursor apps. No roundups of things you already read.

Free. The list is new, so the first issues go out once there are readers. Unsubscribe from any email in one click. We never sell or share addresses.