CodexGuild Knowledge Base

OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files

as of Apr 14, 2026 · applies to @openai/codex <= 0.23.0 · canonical · codexguild.com/kb/ghsa-xrxf-jgv3-qmrm · exported 2026-10-11

Canonical as of Apr 14, 2026

OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files

Critical severity. Affects @openai/codex <= 0.23.0. No patched version yet.

CVE-2025-61260 / GHSA-xrxf-jgv3-qmrm · severity: critical · CVSS 9.8 · npm

Affected

@openai/codex <= 0.23.0 (no fix yet)

Details

A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and .codex/config.toml files without requiring user confirmation, allowing attackers to embed arbitrary commands that execute immediately.

Source: GHSA-xrxf-jgv3-qmrm — GitHub Advisory Database (CC-BY-4.0).