CVE-2025-59532: 
JavaScript vulnerability analysis and mitigation

Codex CLI, a coding agent from OpenAI that runs locally, was found to contain a critical security vulnerability (CVE-2025-59532) affecting versions 0.2.0 through 0.38.0. The vulnerability was discovered on September 22, 2025, and involves a bug in the sandbox configuration logic that could allow the CLI to treat a model-generated working directory as the sandbox's writable root, including paths outside of the user's intended session folder (GitHub Advisory).

The vulnerability stems from improper validation in the sandbox configuration logic where the system could incorrectly handle the working directory (cwd) permissions. The bug allowed the sandbox to treat model-generated paths as valid writable roots, even when they existed outside the intended workspace boundary. This vulnerability has been assigned a CVSS v4.0 base score of 8.6 (High), with the following vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The vulnerability is classified under CWE-20 (Improper Input Validation) (GitHub Advisory, NVD).

The vulnerability enables arbitrary file writes and command execution wherever the Codex process has permissions, effectively bypassing the intended workspace boundary restrictions. While the network-disabled sandbox restriction remained intact, the bug could allow attackers to perform unauthorized operations outside the intended working directory (GitHub Advisory).

The vulnerability has been patched in Codex CLI version 0.39.0, which implements proper canonicalization and validation of sandbox policy boundaries based on the user's session start location. Users running version 0.38.0 or earlier should immediately update via their package manager or reinstall the latest Codex CLI. For users of the Codex IDE extension, updating to version 0.4.12 is required to patch the sandbox issue (GitHub Advisory).

The vulnerability was responsibly disclosed by security researcher Tzanko Matev (Codetracer), and OpenAI promptly addressed the issue with a patch release. The fix was merged into the main branch as part of release 0.39.0, which included several other improvements and bug fixes (GitHub Release).