CVE-2025-59532
In affected versions of Codex CLI and the Codex IDE extension, the model could select a directory that was not part of the user's workspace. The sandbox could then let commands write files or run programs in that directory.
Affected products & versions
Affected products & versions
| Vendor | Product | Affected versions |
|---|---|---|
| OpenAI | Codex CLI | 0.2.0–0.38.0 |
| OpenAI | Codex IDE extension for Visual Studio Code | 0.4.11 or a previous version |
Version ranges are inclusive.
Impact
Commands could write files or run programs wherever the Codex process had permission. If the sandbox blocked network access, that restriction still applied.
Conditions
Conditions
The session had to use the workspace-write sandbox. A command from the model had to specify a working directory that was not part of the workspace.
Known exploitation
Known exploitation
No known abuse in the wild.
Mitigations
Mitigations
- Update Codex CLI to version 0.39.0 or a subsequent version.
- Update the Codex IDE extension for Visual Studio Code to version 0.4.12 or a subsequent version.
Vulnerability description
Codex used the working directory from the model's command to set the sandbox's writable directory. This could let a command write to a directory that the user had not authorized for the workspace. The fix uses the directory where the user started the session to set the workspace boundary.
Problem type
CWE-20(opens in a new window) — Improper Input Validation.
Credits
Credits
Tzanko Matev (Codetracer).
References
Author
Publication and revision history
| Date | Change |
|---|---|
| September 22, 2025 | Original publication of the CVE record(opens in a new window). |
| October 30, 2026 | Publication on openai.com. |