ACVE-2026-0011

The configuration

Configuration label

codex-cli + trust.level=trusted + permissionMode=bypassPermissions

Affected entries

• AgentHarness: codex-cli — SEMVER (introduced 0)

Matcher

• all
  • harness.id eq "codex-cli"
  • trust.level eq "trusted"
  • permissionMode eq "bypassPermissions"
  • trust.scopePath regex "^(~|[A-Za-z]:)/?$"

Why it is exploitable

What the vulnerability is

Codex CLI becomes over-privileged when it trusts a root-level scope and also bypasses permission approvals. A repository or file beneath that trusted root can then be handled under a policy that does not ask before executing tools. This ACVE-native advisory identifies the configuration combination, not a particular command or repository.

Which configuration is exposed

The matcher requires harness.id codex-cli, trust.level trusted, permissionMode bypassPermissions, and trust.scopePath matching ^(~|[A-Za-z]:)/?$. That expression covers the tokenised home marker ~ or ~/, and a drive root such as C: or C:/. These conditions are intentionally narrow: a trusted subdirectory does not match this rule.

How ACVE detects it

ACVE reads harness.id, trust.level, permissionMode, and trust.scopePath. The path is a tokenised lockfile value, not a filesystem lookup; ACVE cannot resolve the user's actual home directory, enumerate files beneath the scope, or determine whether a tool has run. It also cannot infer whether the trusted root was intentional.

Fix

1. Change bypassPermissions to default or another approval-required mode.
2. Narrow the trusted scope from the home or drive root to the specific project directory that needs trust.
3. Rebuild the lockfile and confirm that both the trust token and effective permission mode are changed.

The two remediation actions address independent trust decisions, so narrowing the path alone does not restore approval prompts.

Together, these checks reduce the scope and restore a human decision point before commands are executed.

Together, these checks reduce the scope and restore a human decision point before commands are executed.

References

See references for primary sources.

Underlying CVEs / aliases

No CVE assigned. ACVE-native configuration weakness; no CVE assigned.

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Require approval and narrow trusted scope to the intended project.

Validation

No validation entries recorded.

Grounding

• OSV: not found; checked-at 2026-09-20T02:43:30Z
• NVD: not found; checked-at 2026-09-20T02:43:30Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:30Z

References

ADVISORY

• https://example.com/research/acve

REPORT

• https://example.com/research/acve