ZDI-26-649: (Pwn2Own) OpenAI Codex Improper Neutralization of Control Sequences Remote Code Execution Vulnerability

OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) misclassify certain PowerShell commands as safe because the command-safety parser handles PowerShell's stop-parsing token (--%) differently from PowerShell itself (CWE-150, improper neutralization of control sequences). An attacker triggers this by preparing a repository whose instructions cause Codex to run a file-writing Git command through PowerShell without the usual user-approval prompt; on macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration, and when Codex later loads the modified configuration, it launches an attacker-controlled MCP server, giving the attacker code execution with the user's privileges and the ability to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing, so the default sandbox on macOS and Linux can prevent writes outside permitted locations and limit the attack. No public PoC or in-the-wild exploitation is currently known; the flaw was demonstrated at Pwn2Own (ZDI-26-649) and carries a low 30-day exploitation probability (EPSS 0.3%).

Do: Update Codex CLI and Codex Desktop to the latest patched release (fixed version numbers are not specified in the available data). Until patched, avoid opening untrusted repositories with Codex and review Codex configuration for unexpected or unapproved MCP server entries; macOS and Linux users should note that exploitation requires locally installed PowerShell Core (pwsh) and that the default filesystem sandbox may already block the configuration write.