N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59532

CVE-2025-59532: Codex has sandbox bypass due to bug in path configuration logic

Due to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session.

This logic bypassed the intended workspace boundary and enables arbitrary file writes and command execution where the Codex process has permissions - this did not impact the network-disabled sandbox restriction.

Remediation We released a patch in Codex CLI 0.39.0 that canonicalizes and validates that the boundary used for sandbox policy is based on where the user started the session, and not the one generated by the model. Users running 0.38.0 or earlier should update immediately via their package manager or by reinstalling the latest Codex CLI to ensure sandbox boundaries are enforced.

If using the Codex IDE extension, users should immediately update to 0.4.12 for a fix of the sandbox issue.

Thank you to Tzanko Matev (Codetracer) for reporting the issue!

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59532

CVE-2025-59532:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@openai/codex	npm	>= 0.2.0, <= 0.38.0	0.39.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in Codex CLI was a sandbox bypass caused by improper handling of the current working directory (cwd). The core issue was that the cwd provided by a language model could be used to define the root of the sandbox's writable area. This allowed a malicious model output to specify a cwd outside of the user's intended workspace, effectively bypassing the sandbox and enabling arbitrary file writes and command execution on the user's machine.

The patch addresses this by separating the concept of the command's working directory from the sandbox's policy boundary. The key changes were made in the functions responsible for spawning sandboxed processes (spawn_command_under_seatbelt for macOS and spawn_command_under_linux_sandbox for Linux) and the functions that call them.

The analysis of the commit 8595237505a1e0faabc2af3db805b66ce3ae182d reveals that these functions were modified to accept two separate path arguments: command_cwd and sandbox_policy_cwd. The command_cwd is the working directory for the executed command (which can be specified by the model), while the sandbox_policy_cwd is a trusted path based on the user's session, used to enforce the sandbox's security policy. By doing this, the sandbox's boundary is no longer determined by potentially malicious model input.

The identified vulnerable functions are the ones that were part of this flawed logic. During an exploit, these functions would be present in the call stack, with run_command_under_sandbox and process_exec_tool_call initiating the process and the spawn_command_under_* functions directly creating the misconfigured sandbox.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.