{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0011",
  "aliases": [],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-19T00:00:00Z",
  "summary": "Codex trusted root scope combined with never-approve execution",
  "details": "## What the vulnerability is\n\nCodex CLI becomes over-privileged when it trusts a root-level scope and also bypasses permission approvals. A repository or file beneath that trusted root can then be handled under a policy that does not ask before executing tools. This ACVE-native advisory identifies the configuration combination, not a particular command or repository.\n\n## Which configuration is exposed\n\nThe matcher requires `harness.id` `codex-cli`, `trust.level` `trusted`, `permissionMode` `bypassPermissions`, and `trust.scopePath` matching `^(~|[A-Za-z]:)/?$`. That expression covers the tokenised home marker `~` or `~/`, and a drive root such as `C:` or `C:/`. These conditions are intentionally narrow: a trusted subdirectory does not match this rule.\n\n## How ACVE detects it\n\nACVE reads `harness.id`, `trust.level`, `permissionMode`, and `trust.scopePath`. The path is a tokenised lockfile value, not a filesystem lookup; ACVE cannot resolve the user's actual home directory, enumerate files beneath the scope, or determine whether a tool has run. It also cannot infer whether the trusted root was intentional.\n\n## Fix\n\n1. Change `bypassPermissions` to `default` or another approval-required mode.\n2. Narrow the trusted scope from the home or drive root to the specific project directory that needs trust.\n3. Rebuild the lockfile and confirm that both the trust token and effective permission mode are changed.\n\nThe two remediation actions address independent trust decisions, so narrowing the path alone does not restore approval prompts.\n\nTogether, these checks reduce the scope and restore a human decision point before commands are executed.\n\nTogether, these checks reduce the scope and restore a human decision point before commands are executed.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "codex-cli"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "5"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "exposure": "local",
      "vulnClasses": [
        "unsafe-permission-mode"
      ],
      "cwe": [
        "CWE-732"
      ],
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "codex-cli"
          },
          {
            "field": "trust.level",
            "op": "eq",
            "value": "trusted"
          },
          {
            "field": "permissionMode",
            "op": "eq",
            "value": "bypassPermissions"
          },
          {
            "field": "trust.scopePath",
            "op": "regex",
            "value": "^(~|[A-Za-z]:)/?$"
          }
        ]
      },
      "fix": {
        "summary": "Require approval and narrow trusted scope to the intended project.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.permissionMode",
            "to": "default",
            "why": "Do not execute tools under a never-approve policy."
          },
          {
            "type": "reconfigure",
            "target": "settings:codex-cli:trust.scopePath",
            "to": "project",
            "why": "Limit trust to the project instead of a home or drive root."
          }
        ]
      },
      "noCveReason": "ACVE-native configuration weakness; no CVE assigned.",
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "found": false,
          "aliasesConfirmed": [],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": []
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "found": false,
          "cvss": null,
          "published": null
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:30Z",
          "confirmed": [],
          "missing": []
        }
      }
    }
  }
}