ACVE-2026-0442

Codex CLI below 0.149.0, using its apply_patch tool in a sandbox, could write outside the intended workspace without a prompt.

Exposure

Harness: Codex CLI below 0.149.0 — detected, www.accomplish.ai
Model: any — unconfirmed
Goal: Any task that uses the apply_patch tool (goal not stated by the source) — unconfirmed
Tools and settings: Codex CLI apply_patch and its workspace sandbox — confirmed, www.accomplish.ai
Approval: The patch could widen the write grant without an approval prompt — detected, www.accomplish.ai
Input controlled by: repo-author
What the agent does: The patch tool writes outside the intended workspace.
Harm: file-write

Reach: Files outside the intended workspace — detected, www.accomplish.ai (the home directory, project files)

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Severity: HIGH
Status: Unverified
Kind: Code
Source date: 2026-09-15
Modified: 2026-09-25
Aliases: No CVE assigned — No CVE was assigned in the public disclosure.
Affected: AgentHarness: codex-cli — < 0.149.0
Harness/product: codex-cli
Classes: path-traversal; sandbox-escape; unsafe-permission-mode; CWE-22; CWE-693
Taxonomy: ASI: ASI05; ASI: ASI02; ATLAS: AML.T0105
Licence: CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

In the wild

demonstrated

Description

What

Accomplish reported Overpatch in Codex CLI: the patch tool's permission grant could reach the parent of a patched path, allowing a patch to write elsewhere on the disk even when the agent was sandboxed.

Detection

Accomplish reported a proof of concept and says Codex CLI 0.149.0 closes Overpatch.

Fix

Upgrade Codex CLI to 0.149.0 or later.

Fix

Upgrade Codex CLI to 0.149.0 or later.

Upgrade harness:codex-cli to 0.149.0. The report identifies this as the Overpatch fix. Owner: operator

Report a problem JSON