OpenAI Codex CLI MCP Configuration Remote Code Execution
A critical vulnerability in OpenAI's Codex CLI allows arbitrary command execution when a user opens a malicious repository containing a specially crafted .codex/config.toml file. OpenAI patched the issue by restricting configuration loading to trusted folders.
What happened
A critical vulnerability exists in OpenAI's Codex CLI that allows arbitrary command execution when a user opens a malicious repository. The Model Context Protocol (MCP) server configuration can be defined through a project-level .codex/config.toml file within an untrusted workspace.
The config loader had multiple code execution entrypoints. OpenAI addressed this on January 20, 2026 by modifying the config loading mechanism to first load configuration from predetermined trusted locations (~/.codex/config.toml), then only load additional configuration from the current working directory if it is in a trusted folder.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.