TI-2025-37063 Aliases CVE-2025-59532 GHSA-w5fx-fh39-j5rw

Codex has sandbox bypass due to bug in path configuration logic

MEDIUM 41CWE-20Published 2025-09-22 · Updated 2025-09-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Codex CLI is a coding agent from OpenAI that runs locally. In versions 0.2.0 to 0.38.0, due to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. This logic bypassed the intended workspace boundary and enables arbitrary file writes and command execution where the Codex process has permissions - this did not impact the network-disabled sandbox restriction. This issue has been patched in Codex CLI 0.39.0 that canonicalizes and validates that the boundary used for sandbox policy is based on where the user started the session, and not the one generated by the model. Users running 0.38.0 or earlier should update immediately via their package manager or by reinstalling the latest Codex CLI to ensure sandbox boundaries are enforced. If using the Codex IDE extension, users should immediately update to 0.4.12 for a fix of the sandbox issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00894 59th percentileScored 2026-11-07

Fix Fixed codex (openai): 0.39.0@openai/codex (npm): 0.39.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenAI	codex	0.2.0 to before 0.39.0	0.39.0	Patch available	CNA
—	@openai/codex (npm)	0.2.0 to before 0.39.0	0.39.0	Patch available	GHSA-w5fx-fh39-j5rw

codex VendorOpenAI Affected 0.2.0 to before 0.39.0 Fixed in 0.39.0 Patch available CNA
@openai/codex (npm) Vendor— Affected 0.2.0 to before 0.39.0 Fixed in 0.39.0 Patch available GHSA-w5fx-fh39-j5rw

Remediation

Fix · CNA codex (openai) Fixed in 0.39.0
Fix · GHSA-w5fx-fh39-j5rw @openai/codex (npm) Fixed in 0.39.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-59532
2026-10-03 Alias added: GHSA-w5fx-fh39-j5rw

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-59532

Other 4

TI-2026-15921 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS… CVSS 3.1HIGH 7.3
TI-2025-06388 OpenAI Operator - API Spoofing through Locking Operator on FullScreen CVSS 4.0MEDIUM 6.9
TI-2026-15922 OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and… CVSS 3.1CRITICAL 9.8
TI-2026-15920 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS… CVSS 3.1HIGH 8.8
TI-2026-85640 Argument injection in Codex Desktop for Windows project paths CVSS 3.1HIGH 8.0
TI-2026-15919 Uncontrolled search path in OpenAI Codex Desktop CVSS 3.1HIGH 7.3

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences