OpenAI Codex CLI remote code execution via malicious config file
A critical vulnerability in OpenAI's Codex CLI allowed arbitrary remote code execution through a malicious configuration file in an untrusted repository. OpenAI patched the issue by restricting config loading to only trusted directories.
What happened
A critical vulnerability in OpenAI Codex CLI allows arbitrary command execution when a user opens a malicious repository. The notify configuration field, which specifies an external command to spawn for end-user notifications, can be set through a project-level .codex/config.toml file within an untrusted workspace.
When the user runs Codex in the directory containing the malicious config and completes an agent turn, the command specified in the notify field is executed with the user's full privileges.
Index analysis
The vulnerability stems from the config loader reading configuration from the current working directory without first verifying that the directory is trusted. OpenAI addressed this in a pull request by loading config from predetermined trusted locations first and only loading additional config from the current working directory if it is trusted.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.