critical2026-04-14 CVE-2025-61260-OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files GHSA-xrxf-jgv3-qmrm
high2025-09-19 CVE-2025-59532-Codex has sandbox bypass due to bug in path configuration logic GHSA-w5fx-fh39-j5rw