Количество 2
Количество 2
CVE-2025-61260
A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and .codex/config.toml files without requiring user confirmation, allowing attackers to embed arbitrary commands that execute immediately.
GHSA-xrxf-jgv3-qmrm
OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2025-61260 A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and .codex/config.toml files without requiring user confirmation, allowing attackers to embed arbitrary commands that execute immediately. | CVSS3: 9.8 | 7% Низкий | 4 месяца назад |
| GHSA-xrxf-jgv3-qmrm OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files | CVSS3: 9.8 | 7% Низкий | 4 месяца назад |
Уязвимостей на страницу