CyberRota Analysis
AI-GeneratedThe OpenAI Codex CLI and Codex Desktop applications for Windows, macOS, and Linux are vulnerable due to a misclassification of certain PowerShell commands, which allows an attacker to execute file-writing Git commands without user consent when a malicious repository is opened. This can lead to unauthorized modifications of Codex's configuration, potentially enabling the execution of arbitrary code with the user's privileges if filesystem protections allow it. Organizations using these applications, particularly those on macOS and Linux with PowerShell Core installed, should prioritize addressing this vulnerability to mitigate risks associated with unauthorized access and data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user's privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations.