What is GHSA-xrxf-jgv3-qmrm?

GHSA-xrxf-jgv3-qmrm is a security advisory published by GitHub Security Advisories with Critical severity. OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files

Which CVE IDs does GHSA-xrxf-jgv3-qmrm cover?

GHSA-xrxf-jgv3-qmrm covers the following CVE IDs: CVE-2025-61260. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xrxf-jgv3-qmrm?

GHSA-xrxf-jgv3-qmrm has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-xrxf-jgv3-qmrm?

GHSA-xrxf-jgv3-qmrm affects 1 product, including: npm/@openai/codex:\u003c= 0.23.0.

GHSA-xrxf-jgv3-qmrmCriticalCVSS 9.8

OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files

Vendor

GitHub Security Advisories

Published

April 14, 2026

Last Modified

April 16, 2026

🔗 CVE IDs covered (1)

CVE-2025-61260 →

📋 Description

A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and .codex/config.toml files without requiring user confirmation, allowing attackers to embed arbitrary commands that execute immediately.

🎯 Affected products1

npm/@openai/codex:<= 0.23.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-61260
https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability
http://openai.com
https://github.com/advisories/GHSA-xrxf-jgv3-qmrm