AI analysis
OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) misclassify certain PowerShell commands as safe because the command-safety parser handles PowerShell's stop-parsing token (--%) differently from PowerShell itself (CWE-150, improper neutralization of control sequences). An attacker triggers this by preparing a repository whose instructions cause Codex to run a file-writing Git command through PowerShell without the usual user-approval prompt; on macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration, and when Codex later loads the modified configuration, it launches an attacker-controlled MCP server, giving the attacker code execution with the user's privileges and the ability to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing, so the default sandbox on macOS and Linux can prevent writes outside permitted locations and limit the attack. No public PoC or in-the-wild exploitation is currently known; the flaw was demonstrated at Pwn2Own (ZDI-26-649) and carries a low 30-day exploitation probability (EPSS 0.3%).
What to do: Update Codex CLI and Codex Desktop to the latest patched release (fixed version numbers are not specified in the available data). Until patched, avoid opening untrusted repositories with Codex and review Codex configuration for unexpected or unapproved MCP server entries; macOS and Linux users should note that exploitation requires locally installed PowerShell Core (pwsh) and that the default filesystem sandbox may already block the configuration write.
Affected
| OpenAI Codex CLI (Windows, macOS, Linux) | — |
| OpenAI Codex Desktop (Windows, macOS) | — |
Estimated exposure
large≈100,000–1,000,000 developer installations (estimate; no install counts in source data) — Codex CLI is a widely adopted OpenAI developer tool with a plausibly six-figure-plus install base, but the exploitable population is narrower because it requires opening an attacker-crafted repository with Codex and, on macOS and Linux, a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user's privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations.