ACVE-2025-0007

The configuration

Configuration label

codex-cli <=0.23.0 + project.configPresent=true

Affected entries

• AgentHarness: codex-cli — SEMVER (introduced 0; fixed 0.23.1)

Matcher

• all
  • harness.id eq "codex-cli"
  • harness.version semverRange "<=0.23.0"
  • features["project.configPresent"] eq true

Why it is exploitable

What the vulnerability is

Codex CLI can auto-load a project configuration when it starts in a repository that contains the relevant project configuration. A repository-controlled configuration can therefore influence the harness before the user has reviewed its contents. The affected range in this record is Codex CLI through 0.23.0, fixed in 0.23.1.

Which configuration is exposed

The exposed combination is Codex CLI with harness.id codex-cli, harness.version <=0.23.0, and the discovered feature project.configPresent set to true. The matcher encodes all three conditions. It does not require a specific configuration key or command and does not distinguish a benign project file from one that changes security-relevant behavior; the presence signal is the deliberate ACVE proxy for repository-controlled configuration.

How ACVE detects it

ACVE reads harness.id, harness.version, and the flat feature key features["project.configPresent"]. The bracket-quoted matcher path is intentional because lockfile feature keys are stored flat. ACVE cannot inspect the project configuration's contents, determine whether a setting was actually consumed, or prove that a project file was attacker-controlled.

Fix

1. Upgrade Codex CLI to 0.23.1 or later.
2. Review and remove project configuration that is not required, especially before opening repositories from an untrusted source.

The presence flag is intentionally less specific than parsing the project file, which keeps the audit conservative when the file format or contents are not available.

The presence flag is intentionally less specific than parsing the project file, which keeps the audit conservative when the file format or contents are not available.

References

See references for primary sources.

Underlying CVEs / aliases

• CVE-2025-61260

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Upgrade Codex CLI to 0.23.1 or later and review project configuration.

Validation

Grounding

• OSV: not found; checked-at 2026-09-20T02:43:24Z
• NVD: found; checked-at 2026-09-20T02:43:24Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:24Z

References

ADVISORY

• https://nvd.nist.gov/vuln/detail/CVE-2025-61260

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=CVE-2025-61260