CVE-2026-19329: Codex MCP Command Injection Vulnerability

CVE-2026-19329 Overview

CVE-2026-19329 is a command injection vulnerability in the andreahaku codex_mcp project, affecting builds up to commit 1ff521cc6cc57cfe56ddef946c644b8534771390. The flaw resides in the src/codex-process-simple.ts file within the ask MCP Tool component. An attacker with local access can manipulate the model argument to inject arbitrary operating system commands. The project does not use versioning, so there are no formal affected or fixed release identifiers. The maintainer was notified through a public issue report but has not responded, and no patch is available at time of publication.

Critical Impact
Local attackers who can supply input to the ask MCP Tool can execute arbitrary commands in the context of the process running codex_mcp, potentially leading to further compromise of the host.

Affected Products

andreahaku codex_mcp (all commits up to 1ff521cc6cc57cfe56ddef946c644b8534771390)
The ask MCP Tool component in src/codex-process-simple.ts
Systems running unversioned builds of codex_mcp without applied fixes

Discovery Timeline

2026-08-09 - CVE-2026-19329 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19329

Vulnerability Analysis

The vulnerability is a command injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). It affects the ask MCP Tool implemented in src/codex-process-simple.ts. The tool accepts a model argument that is passed to a downstream process invocation without sufficient sanitization. When shell metacharacters or additional command tokens are supplied in the model value, they are interpreted by the underlying shell or process spawn logic. This allows an attacker who can reach the tool locally to execute commands outside the intended parameter scope.

Root Cause

The root cause is improper neutralization of special elements in the model argument before it is forwarded to a child process. The Model Context Protocol (MCP) tool constructs a process invocation using attacker-controllable input without escaping or strict allowlisting. Because the argument is treated as part of a command string rather than as a strictly validated parameter, injected characters change the semantics of the executed command.

Attack Vector

Exploitation requires local access and low privileges. The attacker must be able to invoke the ask MCP Tool, for example through a locally connected MCP client, and control the model parameter. Successful injection yields code execution in the context of the process hosting codex_mcp. Confidentiality, integrity, and availability impacts are each limited in scope according to the published CVSS 4.0 vector.

No verified public exploit code is available. Technical details are described in the GitHub Issue #1 and the VulDB entry for CVE-2026-19329.

Detection Methods for CVE-2026-19329

Indicators of Compromise

Unexpected child processes spawned by the Node.js runtime hosting codex_mcp, especially shell interpreters such as /bin/sh, bash, or cmd.exe.
MCP request logs containing unusual characters in the model parameter, including ;, &&, |, backticks, or $( sequences.
New files, cron entries, or outbound network connections originating from the codex_mcp process shortly after ask tool invocations.

Detection Strategies

Enable verbose logging on the MCP server and inspect the model argument for shell metacharacters or overly long values.
Apply behavioral monitoring on developer workstations to flag process trees where an MCP host spawns interactive shells or system utilities such as curl, wget, or nc.
Correlate MCP tool invocations with endpoint telemetry to identify anomalous command execution patterns that follow model selection events.

Monitoring Recommendations

Collect and retain command-line arguments for processes spawned by the codex_mcp runtime.
Alert on any execution of scripting interpreters or file transfer utilities under the MCP host process.
Monitor the andreahaku/codex_mcp GitHub repository for maintainer responses, patches, or forks that address this issue.

How to Mitigate CVE-2026-19329

Immediate Actions Required

Restrict access to the codex_mcp server to trusted local users only and disable exposure to untrusted clients.
Remove or disable the ask MCP Tool if it is not required in your workflow.
Run codex_mcp under a dedicated low-privilege account with no access to sensitive files, credentials, or secrets.

Patch Information

No official patch is available. The maintainer has been notified through GitHub Issue #1 but has not responded. Because the project does not use versioning, users must track fixes at the commit level. Review commits after 1ff521cc6cc57cfe56ddef946c644b8534771390 for changes to src/codex-process-simple.ts that validate or allowlist the model argument.

Workarounds

Fork the repository and apply a strict allowlist on the model argument, rejecting any value containing characters outside [A-Za-z0-9._-].
Replace shell-style process invocation with an execFile-equivalent call that passes arguments as an array, preventing shell interpretation.
Isolate the MCP host in a container or sandbox with restricted filesystem, network, and syscall access to limit blast radius.

bash

# Example hardening: run codex_mcp under a restricted user and namespace
useradd -r -s /usr/sbin/nologin codexmcp
sudo -u codexmcp systemd-run --user --scope \
  --property=NoNewPrivileges=yes \
  --property=ProtectSystem=strict \
  --property=PrivateTmp=yes \
  node /opt/codex_mcp/dist/index.js