CVE-2025-61260 — OpenAI Codex CLI: Command Injection via Project-Local Configuration

The article discusses a critical vulnerability (CVE-2025-61260) in OpenAI's Codex CLI, which allows command injection through project-local configuration files. The vulnerability arises from the CLI's automatic loading and execution of MCP server entries from a project's configuration without user consent or validation. This can lead to arbitrary command execution, enabling attackers to embed malicious payloads in seemingly benign project files.

The research highlights the potential for persistent remote access, silent command execution, and the risk of compromising developer machines. A responsible disclosure was made to OpenAI, which issued a fix in version 0.23.0 of Codex CLI, preventing the exploitation of this vulnerability.