CVE-2025-61260 affects OpenAI Codex CLI up to version 0.23.0. The vulnerability arises because the tool automatically loads project-local environment and configuration files (.env and .codex/config.toml) without requiring user confirmation. An attacker who controls or compromises a repository can embed malicious commands in these files, which are executed immediately when the codex command is run. This leads to unauthenticated remote code execution with high impact on confidentiality, integrity, and availability. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and full compromise impact. There is no vendor advisory or patch information currently available.

Successful exploitation results in remote code execution on the user's system running the vulnerable Codex CLI, allowing attackers to execute arbitrary commands with the privileges of the user running the tool. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability requires no privileges or user interaction beyond running the codex command in a malicious repository.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running the codex command inside untrusted or potentially compromised repositories to prevent automatic loading and execution of malicious configuration files.