Description

A vulnerability was found in andreahaku codex_mcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/codex-process-simple.ts of the component ask MCP Tool. The manipulation of the argument model results in command injection. The attack requires a local approach. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T04:17:37.780Z",
  "pubdate": "2026-08-09T04:17:37.780Z",
  "executiveSummary": "A command injection vulnerability has been identified in the ask MCP Tool component of andreahaku codex_mcp up to commit 1ff521cc6cc57cfe56ddef946c644b8534771390.\nThe vulnerability resides in the src/codex-process-simple.ts file, specifically within an unknown function processing the model argument.\nSuccessful exploitation of this flaw allows a local attacker to execute arbitrary system commands with the privileges of the application running the MCP Tool.\nThe attack vector requires local access to the system to manipulate the vulnerable input parameter.\nThe product does not implement formal versioning, and no patched releases are currently available as the project has not responded to initial disclosures.\nThe primary risk implications include complete system compromise, unauthorized execution of arbitrary code, and potential data exfiltration or tampering within the local host environment.",
  "technicalDetails": "The vulnerability is caused by insufficient input validation and sanitization of the model argument passed to the underlying system execution routines within src/codex-process-simple.ts.\nWhen a user or local actor interacts with the ask MCP Tool, the supplied model parameter is improperly concatenated or passed unsafely to a command execution sink, allowing shell metacharacters to be interpreted and executed by the underlying operating system shell.\nThe attack flow requires the attacker to have local access to interact with the affected component.\nBy supplying a crafted string containing command separators or injection payloads via the model argument, an attacker can coerce the process into executing unintended system binaries or shell scripts.\nThe affected component is the ask MCP Tool implemented in src/codex-process-simple.ts.\nThe affected version range encompasses all commits up to 1ff521cc6cc57cfe56ddef946c644b8534771390, noting that the project lacks formal versioning.\nAuthentication and privilege requirements depend on the local environment access controls, but typically leverage the execution privileges of the local user running the codex_mcp process.\nNetwork exposure is local, as the attack requires a local approach rather than remote network-based exploitation vectors.\nThe payload behavior involves the direct execution of arbitrary operating system commands injected through the vulnerable parameter, leading to immediate post-exploitation impact such as unauthorized local privilege escalation, file system modification, or execution of malicious payloads."
}