The vulnerability arises when the OpenAI Codex CLI automatically loads project‑local configuration files without user confirmation. Malicious content placed in .env or .codex/config.toml can be executed immediately, giving an attacker the ability to run arbitrary commands on the host where the CLI is invoked. This flaw represents a command‑injection style weakness that directly compromises confidentiality, integrity, and availability of the local system.

The affected product is the OpenAI Codex Command Line Interface version 0.23.0 and any earlier release. The issue is triggered in any repository that contains a .env file or a .codex/config.toml file designed by an attacker. The CLI processes these files automatically whenever a codex command is executed within that repository, regardless of the repository’s provenance.

The CVSS score is 9.8, and the EPSS metric is < 1 %; the vulnerability is not listed in the CISA KEV catalog. However, the attack requires only that the user runs a codex command in a repository that can be influenced by an attacker, which is a realistic scenario in collaborative or publicly hosted projects. Because the vulnerability allows local execution of arbitrary code, the risk can be considered high, especially in environments where the CLI is used frequently or where repository content is not strictly trusted.