CVE-2025-61260 — OpenAI Codex CLI Command Injection via Proj...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/
• Blog Title: CVE-2025-61260 — OpenAI Codex CLI: Command Injection via Project-Local Configuration
• Suggested Section: 🤩 Generic Methodologies & Resources -> Pentesting Methodology (new subsection on abusing developer tooling & project-local configuration / env vars for auto-exec RCE, including Codex CLI MCP command execution via CODEX_HOME hijack)

🎯 Content Summary

This blog analyzes CVE-2025-61260, a command-injection / arbitrary command-execution vulnerability in the OpenAI Codex CLI caused by how it implicitly trusts and executes project-local Model Context Protocol (MCP) server definitions when configuration is redirected via a repository-controlled .env file.

Background: Codex CLI and MCP
OpenAI Codex CLI is a terminal tool that can read, edit, and run...

🔧 Technical Details

Abusing project-local .env to hijack CODEX_HOME
The core trick is to use a repository-controlled .env file to override the CODEX_HOME environment variable, e.g. setting CODEX_HOME=./.codex. When a developer runs codex inside that repo, Codex resolves configuration from ./.codex instead of a trusted global directory. This lets the repository author fully control the configuration Codex treats as authoritative, without any extra consent from the user.

Turning MCP server configuration into an auto-exec RCE primitive
Once CODEX_HOME is redirected into the project, the attacker adds a ./.codex/config.toml that defines one or more mcp_servers entries. Because Codex automatically materializes MCP servers at startup, it will invoke mcp_servers.<name>.command with the specified args every time it starts....

🤖 Agent Actions

Summary:

• Expanded the Phishing phase of the Pentesting Methodology with a new “Abusing AI Developer Tooling Auto-Exec (Codex CLI MCP)” subsection. It details how repo-controlled .env files can hijack CODEX_HOME, drop malicious MCP server definitions, and gain automatic RCE whenever codex runs, including workflow steps, command snippets, operational guidance, and mitigations (upgrade to ≥0.23.0, guard .env/dot-directories, monitor suspicious child processes).
• Added a References section to the page, citing the Check Point Research write-up on CVE-2025-61260 that informed the update.

Tests: Not run (not applicable).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2025/openai-codex-cli-command-injection-vulnerability/

Content Categories: Based on the analysis, this content was categorized under "🤩 Generic Methodologies & Resources -> Pentesting Methodology (new subsection on abusing developer tooling & project-local configuration / env vars for auto-exec RCE, including Codex CLI MCP command execution via CODEX_HOME hijack)".

Repository Maintenance:

• MD Files Formatting: 914 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0