OpenAI Codex CLI versions 0.23.0 and earlier are vulnerable to arbitrary code execution via malicious MCP configuration files. The attack vector involves placing crafted .env or .codex/config.toml files in a repository. When a user runs the codex command within that repository, the CLI automatically loads these files without prompting, executing embedded commands immediately. This behavior results in remote code execution without requiring user interaction or privileges. The vulnerability is tracked as CVE-2025-61260 with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No official patch or remediation guidance is currently provided, and no known exploits in the wild have been reported.

Successful exploitation leads to remote, unauthenticated, and automatic execution of arbitrary commands on the user's system when running the codex CLI inside a malicious repository. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability does not require user interaction beyond running the codex command and does not require privileges, making it highly severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid running the codex CLI command inside untrusted or unverified repositories to prevent automatic loading of malicious configuration files. Monitoring for updates from OpenAI regarding patches or mitigations is strongly recommended.