{
  "schema_version": "1.6.0",
  "id": "ACVE-2025-0007",
  "aliases": [
    "CVE-2025-61260"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-20T02:45:17.577Z",
  "summary": "Codex CLI can auto-load project configuration",
  "details": "## What the vulnerability is\n\nCodex CLI can auto-load a project configuration when it starts in a repository that contains the relevant project configuration. A repository-controlled configuration can therefore influence the harness before the user has reviewed its contents. The affected range in this record is Codex CLI through `0.23.0`, fixed in `0.23.1`.\n\n## Which configuration is exposed\n\nThe exposed combination is Codex CLI with `harness.id` `codex-cli`, `harness.version` `<=0.23.0`, and the discovered feature `project.configPresent` set to `true`. The matcher encodes all three conditions. It does not require a specific configuration key or command and does not distinguish a benign project file from one that changes security-relevant behavior; the presence signal is the deliberate ACVE proxy for repository-controlled configuration.\n\n## How ACVE detects it\n\nACVE reads `harness.id`, `harness.version`, and the flat feature key `features[\"project.configPresent\"]`. The bracket-quoted matcher path is intentional because lockfile feature keys are stored flat. ACVE cannot inspect the project configuration's contents, determine whether a setting was actually consumed, or prove that a project file was attacker-controlled.\n\n## Fix\n\n1. Upgrade Codex CLI to `0.23.1` or later.\n2. Review and remove project configuration that is not required, especially before opening repositories from an untrusted source.\n\nThe presence flag is intentionally less specific than parsing the project file, which keeps the audit conservative when the file format or contents are not available.\n\nThe presence flag is intentionally less specific than parsing the project file, which keeps the audit conservative when the file format or contents are not available.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "codex-cli"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61260"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=CVE-2025-61260"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "8"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "published",
      "vulnClasses": [
        "config-autoload"
      ],
      "cwe": [
        "CWE-15"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI05 Improper Output Handling"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "codex-cli"
          },
          {
            "field": "harness.version",
            "op": "semverRange",
            "value": "<=0.23.0"
          },
          {
            "field": "features[\"project.configPresent\"]",
            "op": "eq",
            "value": true
          }
        ]
      },
      "fix": {
        "summary": "Upgrade Codex CLI to 0.23.1 or later and review project configuration.",
        "actions": [
          {
            "type": "upgrade",
            "target": "harness:codex-cli",
            "to": "0.23.1",
            "why": "Use the fixed release."
          }
        ]
      },
      "exposure": "local",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:24Z",
          "found": false,
          "aliasesConfirmed": [],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": []
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:24Z",
          "found": true,
          "cvss": 9.8,
          "published": "2026-04-14T15:16:24.487"
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:24Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:24Z",
          "confirmed": [],
          "missing": []
        }
      },
      "validatedBy": [
        {
          "who": "Mark Pickering (PickBits) via Claude Code session 01YR6ri2tM3jU9vdQNe9R5pw",
          "date": "2026-09-20",
          "method": "vendor-advisory",
          "evidence": "https://github.com/advisories/GHSA-xrxf-jgv3-qmrm",
          "note": "Codex CLI <= 0.23.0 auto-loads project-local .codex/config.toml MCP servers; NVD CVSS 9.8."
        }
      ]
    }
  }
}