Vulnerability in codex project
Resolved 💬 2 comments Opened Mar 26, 2026 by ankitdn Closed Mar 26, 2026
💡 Likely answer: A maintainer (etraut-openai, contributor)
responded on this thread — see the highlighted reply below.
What issue are you seeing?
While working in codex project, I found that the application uses picomatch, which is affected by a method injection vulnerability (CVE-2026-33672). The issue occurs in POSIX character class handling, where crafted patterns (e.g., [[:constructor:]]) can inject inherited object methods into the regex. This may lead to incorrect glob matching and impact applications relying on pattern-based access control or validation.
What steps can reproduce the bug?
Scan the manifest file with vulert
What is the expected behavior?
_No response_
Additional information
_No response_
2 Comments
Which Codex product or binary are you referring to here? The Codex app (electron app) binary? The Codex CLI?
Please don't file these automated theoretical bug reports in our issue tracker. We already have dependency tracking in place and monitor for potential vulnerabilities.