{"schema_version":"0.10.0","id":"LR-2026-0366","record_version":1,"title":"OpenAI Codex CLI command injection via project-local MCP configuration (CVE-2025-61260)","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":42.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.56,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"Check Point Research research","original_document":{"url":"https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/","organisation":"Check Point Research","role":"researcher"},"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"Check Point Research research"}]},"sources_hash":"06ce3f1c31bf926b5cde1c7ef7b15b336e7dd487c64d73c86944c28c3c4be000"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"OpenAI Codex CLI","tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Interact with projects from the terminal using natural language commands, automate tasks and streamline day-to-day development","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2025-12-01","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"OpenAI's Codex CLI is a command-line tool that reads, edits and runs code from the terminal and supports MCP server integrations. Check Point Research found that the CLI automatically loaded and executed MCP server entries from a project-local configuration whenever codex was run inside that repository, with no interactive approval or re-check when values changed. Researchers demonstrated the path with a harmless file-creation payload and with reverse-shell payloads, both of which ran without user prompts. The researchers disclosed the issue to the OpenAI Codex CLI team on August 7, 2025. OpenAI issued a fix on August 20, 2025 in version 0.23.0, which stops .env files from redirecting CODEX_HOME into project directories.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test: unbounded scope stated. The source says the flaw enables remote code execution in any environment where developers run codex against a repository. No exploitation in the wild is stated.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/","publisher":"Check Point Research","date":"2025-12-01","type":"press","title":"CVE-2025-61260 — OpenAI Codex CLI: Command Injection via Project-Local Configuration - Check Point Research","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.harness":"C","system.intended_use":"C","event.incident_class":"C","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.harness":[{"source_index":0,"quote":"OpenAI Codex CLI is OpenAI’s command-line tool that brings AI model-backed reasoning into developer workflows."}],"system.intended_use":[{"source_index":0,"quote":"It can read, edit, and run code directly from the terminal, making it possible to interact with projects using natural language commands, automate tasks, and streamline day-to-day development"}],"event.incident_class":[{"source_index":0,"quote":"This vulnerability enables silent, repeatable remote code execution in any environment where developers run codex against a repository."}],"impact.severity":[{"source_index":0,"quote":"This vulnerability enables silent, repeatable remote code execution in any environment where developers run codex against a repository."}],"impact.severity_because":[{"source_index":0,"quote":"This vulnerability enables silent, repeatable remote code execution in any environment where developers run codex against a repository."}],"event.summary":[{"source_index":0,"quote":"It can read, edit, and run code directly from the terminal, making it possible to interact with projects using natural language commands, automate tasks, and streamline day-to-day development"},{"source_index":0,"quote":"Concretely, if a repository contains a .env that sets CODEX_HOME=./.codex and an accompanying ./.codex/config.toml with mcp_servers entries, Codex CLI resolves its config to that local folder, parses the MCP definitions, and invokes the declared command/args immediately at startup."},{"source_index":0,"quote":"There is no interactive approval, no secondary validation of the command or arguments, and no re-check when those values change — the CLI treats the project-local MCP configuration as trusted execution material."},{"source_index":0,"quote":"In practice, we demonstrated this with deterministic payloads (file-creation) and by replacing benign commands with reverse-shell payloads; both executed without user prompts."},{"source_index":0,"quote":"Check Point Research responsibly disclosed the issue to the OpenAI Codex CLI team on August 7, 2025."},{"source_index":0,"quote":"OpenAI issued a fix on August 20, 2025, in Codex CLI version 0.23.0."},{"source_index":0,"quote":"The patch prevents .env files from silently redirecting CODEX_HOME into project directories, closing the automatic execution path we demonstrated."}]},"notes_on_gaps":"Single press source (Check Point Research, dated 2025-12-01 in the source header; that publication date is not a sentence in the body so date_disclosed is omitted). The CVE identifier comes from the incident title and is not stated in the source body. No date of occurrence or detection, no affected version range, no count of affected parties, no exploitation in the wild, and no data exposure are stated. The attack was demonstrated in research, so no agent involvement, trigger, or adversarial actor is stated and those fields are omitted. Judgement: the CLI executes project config rather than acting as an autonomous agent, so agent fields are left out. Root cause is marked unknown because the source does not classify it; root_cause_detail describes the failed trust in project-local config. Severity major is my judgement from the unbounded 'any environment' wording. Model name, version, deployment context, lifecycle stage and country are not stated. Control mapping (B1, C3, C1, E3, J1) is my inference from the source's described gaps and fixes. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (Check Point Research research)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Codex CLI reads, edits and runs code from the terminal for developers.","quote":"It can read, edit, and run code directly from the terminal, making it possible to interact with projects using natural language commands, automate tasks, and streamline day-to-day development","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The CLI loaded and ran MCP server commands from a project-local config without approval, validation or re-checks.","quote":"There is no interactive approval, no secondary validation of the command or arguments, and no re-check when those values change — the CLI treats the project-local MCP configuration as trusted execution material.","source_index":0,"grade":"C"},{"step":"reached","text":"An attacker who could commit or merge the repository files could run commands on developers who cloned it and ran codex.","quote":"This sequence turns ordinary repository files into an execution vector: an attacker who can commit or merge a .env and a ./.codex/config.toml can cause arbitrary commands to run on any developer who clones the repo and runs codex.","source_index":0,"grade":"C"},{"step":"caught","text":"Check Point Research found the flaw in testing and disclosed it to OpenAI on August 7, 2025.","quote":"Check Point Research responsibly disclosed the issue to the OpenAI Codex CLI team on August 7, 2025.","source_index":0,"grade":"C"},{"step":"done","text":"OpenAI fixed the flaw in Codex CLI 0.23.0 on August 20, 2025.","quote":"OpenAI issued a fix on August 20, 2025, in Codex CLI version 0.23.0.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/"]},"analysis":{"sections":{"timeline":[{"text":"Responsible disclosure of the issue to the OpenAI Codex CLI team.","quote":"Check Point Research responsibly disclosed the issue to the OpenAI Codex CLI team on August 7, 2025.","source_index":0,"when":"2025-08-07"},{"text":"OpenAI issued a fix in Codex CLI version 0.23.0.","quote":"OpenAI issued a fix on August 20, 2025, in Codex CLI version 0.23.0.","source_index":0,"when":"2025-08-20"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/"]}}