Vulnerability in codex project

Resolved 💬 2 comments Opened Mar 26, 2026 by ankitdn Closed Mar 26, 2026

What issue are you seeing?

While working in codex project, I found that the application uses picomatch, which is affected by a method injection vulnerability (CVE-2026-33672). The issue occurs in POSIX character class handling, where crafted patterns (e.g., [[:constructor:]]) can inject inherited object methods into the regex. This may lead to incorrect glob matching and impact applications relying on pattern-based access control or validation.

CVE Report
CVE Link

What steps can reproduce the bug?

Scan the manifest file with vulert

What is the expected behavior?

_No response_

Additional information

_No response_

View original on GitHub ↗

This issue has 2 comments on GitHub. Read the full discussion on GitHub ↗