CVE-2025-59532: Codex CLI sandbox bypass allowing arbitrary file writes and command execution
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-59532
- Published
- Record updated
- Affected
- @openai/codex >= 0.2.0, <= 0.38.0
- Fixed in
- 0.39.0
- released September 18, 2025, 5 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.9%
Summary
CVE-2025-59532 affects Codex CLI, OpenAI's locally run coding agent, in versions 0.2.0 to 0.38.0. A bug in the sandbox configuration logic let Codex CLI treat a model-generated cwd as the sandbox's writable root, even for paths outside the folder where the session started. This bypassed the workspace boundary and enabled arbitrary file writes and command execution with the permissions of the Codex process, though the network-disabled sandbox restriction was not affected.
Mitigation
Fixed in Codex CLI 0.39.0, which canonicalizes and validates the sandbox policy boundary against where the user started the session rather than the model-generated path. Users on 0.38.0 or earlier should update immediately via their package manager or by reinstalling the latest Codex CLI. Users of the Codex IDE extension should update to 0.4.12.
Topics
Related items
- MediumCVE-2026-111372: AI ChatBot for WooCommerce WoowBot plugin authorization bypass in RAG syncSame vendor · NVD/CVE Database
- HighCVE-2026-107685: req_llm WebSocket streaming client accepts untrusted TLS certificatesSame vendor · NVD/CVE Database
- MediumCVE-2026-113459: TYPO3 OpenAI API key exposed to backend users in page sourceSame vendor · NVD/CVE Database
- MediumCVE-2026-109296: Open WebUI missing authorization lets users reach disabled model backendsSame vendor · NVD/CVE Database
- MediumCVE-2026-107430: VideoWhisper Site Manager for ChatGPT, Claude, Codex missing authorization checkSame vendor · NVD/CVE Database