Скачать или смотреть CVE-2025-61260: OpenAI Codex CLI Command Injection Vulnerability Explained

A critical command injection vulnerability (CVE-2025-61260) has been discovered in OpenAI Codex CLI, allowing attackers to execute arbitrary commands on a developer's machine. This video explains how the vulnerability works, its potential impact, and how to protect yourself.
The vulnerability stems from insecure handling of project-local configuration files, specifically the .env and config.toml files used by the Model Context Protocol (MCP). An attacker can craft malicious files that, when loaded by Codex CLI, execute commands without user interaction.
We'll cover:
The technical details of the vulnerability.
Real-world consequences, including remote access, data exfiltration, and supply chain attacks.
The fix implemented in Codex CLI version 0.23.0.
Recommendations for staying protected. Update now!