CVE-2025-55345
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Unsafe symlink following in restricted workspace-write sandbox leads to RCE
Using Codex CLI in workspace-write mode inside a malicious context (repo, directory, etc) could lead to arbitrary file overwrite and potentially remote code execution due to symlinks being followed outside the allowed current working directory.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
@openai/codex
- Vendor
- Unknown
- Product
- Unknown
- Platforms
- Unknown
- Default status
Unknown- Package
- @openai/codex
- Package collection
- https://www.npmjs.com
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | semver | 0.12.0 | Unavailable | None listed |