CVE-2025-59532: Codex CLI Sandbox Bypass RCE Vulnerability

CVE-2025-59532 Overview

CVE-2025-59532 affects OpenAI Codex CLI, a coding agent that runs locally on developer workstations. Versions 0.2.0 through 0.38.0 contain a sandbox configuration flaw that allows the language model to influence the writable root of the sandbox. The agent treats a model-generated current working directory (cwd) as the sandbox boundary, including paths outside the user's session folder. This bypass enables arbitrary file writes and command execution within the permissions of the Codex process. The network-disabled sandbox restriction is not affected. OpenAI released a fix in Codex CLI 0.39.0 and Codex IDE extension 0.4.12.

Critical Impact
A model-influenced cwd value can escape the intended workspace boundary, granting attackers arbitrary file write and command execution on the host running Codex CLI.

Affected Products

OpenAI Codex CLI versions 0.2.0 through 0.38.0
OpenAI Codex IDE extension versions prior to 0.4.12
Developer workstations running Codex CLI with default sandbox configuration

Discovery Timeline

2025-09-22 - CVE-2025-59532 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-59532

Vulnerability Analysis

Codex CLI runs untrusted model output inside a sandbox that restricts writes to a defined workspace root. The vulnerability stems from improper input validation [CWE-20] in the sandbox configuration logic. The agent accepted a cwd value produced by the model and used it as the sandbox's writable root. Because the model can generate any path, the sandbox boundary extends to arbitrary directories on the filesystem. An attacker who can influence model output, through prompt injection or a malicious repository, can redirect writes outside the user's session directory. The result is arbitrary file write and command execution at the privileges of the Codex process.

Root Cause

The root cause is a conflation of two distinct concerns: the conversation cwd (where the agent reasons about files) and the sandbox cwd (the trust boundary). The patch in commit 8595237 separates these concerns and canonicalizes the sandbox root from the directory where the user started the session, not from model output.

Attack Vector

Exploitation requires the user to run Codex CLI on input that an attacker controls or can influence. A malicious repository, README, or prompt injection payload instructs the model to emit a crafted cwd value. Codex CLI then applies the attacker-chosen path as the sandbox writable root, permitting writes to user home directories, shell configuration files, or SSH keys.

rust

// Patch: codex-rs/cli/src/debug_sandbox.rs
     sandbox_type: SandboxType,
 ) -> anyhow::Result<()> {
     let sandbox_mode = create_sandbox_mode(full_auto);
-    let cwd = std::env::current_dir()?;
     let config = Config::load_with_cli_overrides(
         config_overrides
             .parse_overrides()
// Source: https://github.com/openai/codex/commit/8595237505a1e0faabc2af3db805b66ce3ae182d

The diff removes the prior cwd source and routes the sandbox boundary through a validated path. A second hunk in codex-rs/core/src/codex.rs adds std::path::Path to support canonicalization of the boundary. See the GitHub Security Advisory GHSA-w5fx-fh39-j5rw for additional detail.

Detection Methods for CVE-2025-59532

Indicators of Compromise

Codex CLI process writes to paths outside the project directory where the session was started, such as ~/.ssh/, ~/.bashrc, or ~/.aws/credentials
Unexpected modifications to shell startup files or git hooks on developer workstations
Codex CLI versions between 0.2.0 and 0.38.0 reported by codex --version
Repository content containing instructions that direct the agent to change its working directory to absolute paths

Detection Strategies

Inventory installed Codex CLI and Codex IDE extension versions across developer endpoints and flag any release below 0.39.0 and 0.4.12 respectively
Monitor process telemetry for codex or codex-rs writing to files outside the session's starting directory
Audit recent agent transcripts for prompts that set an absolute cwd, especially paths outside the project tree

Monitoring Recommendations

Enable file integrity monitoring on sensitive paths under user home directories, including ~/.ssh, ~/.config, and shell rc files
Collect command execution logs from developer workstations and alert on child processes spawned by codex that operate outside the project root
Track repository pulls that immediately precede Codex CLI invocations to correlate suspect content with agent behavior

How to Mitigate CVE-2025-59532

Immediate Actions Required

Upgrade Codex CLI to version 0.39.0 or later using the package manager or by reinstalling from the official release
Upgrade the Codex IDE extension to version 0.4.12 or later
Revoke and rotate any credentials accessible from developer workstations that ran vulnerable Codex CLI versions on untrusted repositories
Audit recent Codex CLI sessions for unexpected file writes outside project directories

Patch Information

The fix is delivered in Codex CLI 0.39.0, tagged as rust-v0.39.0. The patch canonicalizes the sandbox boundary using the directory where the user started the session, rather than a value supplied by the model. Commit 8595237 implements the separation of conversation cwd and sandbox cwd.

Workarounds

If immediate upgrade is not possible, run Codex CLI inside a dedicated container or virtual machine with no access to credentials or sensitive host paths
Avoid running Codex CLI against untrusted repositories or content sources until the upgrade is applied
Restrict the user account running Codex CLI to a least-privilege profile with no write access outside the project directory

bash

# Verify Codex CLI is patched
codex --version
# Expected: 0.39.0 or later

# Upgrade via npm
npm install -g @openai/codex@latest