Vulnerability in codex project
Resolved 💬 2 comments Opened Mar 26, 2026 by ankitdn Closed Mar 26, 2026
What issue are you seeing?
While working in codex project, I found that the application uses picomatch, which is affected by a method injection vulnerability (CVE-2026-33672). The issue occurs in POSIX character class handling, where crafted patterns (e.g., [[:constructor:]]) can inject inherited object methods into the regex. This may lead to incorrect glob matching and impact applications relying on pattern-based access control or validation.
What steps can reproduce the bug?
Scan the manifest file with vulert
What is the expected behavior?
_No response_
Additional information
_No response_
This issue has 2 comments on GitHub. Read the full discussion on GitHub ↗