CVE-2025-59532

Codex CLI is a coding agent from OpenAI that runs locally. In versions 0.2.0 to 0.38.0, due to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. This logic bypassed the intended workspace boundary and enables arbitrary file writes and command execution where the Codex process has permissions - this did not impact the network-disabled sandbox restriction. This issue has been patched in Codex CLI 0.39.0 that canonicalizes and validates that the boundary used for sandbox policy is based on where the user started the session, and not the one generated by the model. Users running 0.38.0 or earlier should update immediately via their package manager or by reinstalling the latest Codex CLI to ensure sandbox boundaries are enforced. If using the Codex IDE extension, users should immediately update to 0.4.12 for a fix of the sandbox issue.

• CWE-20

• https://github.com/openai/codex/commit/8595237505a1e0faabc2af3db805b66ce3ae182d
• https://github.com/openai/codex/releases/tag/rust-v0.39.0
• https://github.com/openai/codex/security/advisories/GHSA-w5fx-fh39-j5rw

Published

Sep 22, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59527Flowise is a drag & drop user interface to build a customize…7.5
• CVE-2025-59528Flowise is a drag & drop user interface to build a customize…10
• CVE-2025-59529Avahi is a system which facilitates service discovery on a l…5.5
• CVE-2025-5953The WP Human Resource Management plugin for WordPress is vul…8.8
• CVE-2025-59530quic-go is an implementation of the QUIC protocol in Go. In …7.5
• CVE-2025-59531Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2025-59534CryptoLib provides a software-only solution using the CCSDS …7.8
• CVE-2025-59535DNN (formerly DotNetNuke) is an open-source web content mana…6.5
• CVE-2025-59536Claude Code is an agentic coding tool. Versions before 1.0.1…8.8
• CVE-2025-59537Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2025-59538Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2025-59539DNN (formerly DotNetNuke) is an open-source web content mana…5.4