CVE-2026-19329
Received Received - Intake

Command Injection in Codex MCP Tool

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A vulnerability was found in andreahaku codex_mcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/codex-process-simple.ts of the component ask MCP Tool. The manipulation of the argument model results in command injection. The attack requires a local approach. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19329
EUVD
EUVD-2026-54862

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
andreahaku codex_mcp to 1ff521cc6cc57cfe56ddef946c644b8534771390 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a command injection flaw in the codex_mcp tool up to a specific commit. It occurs when the model parameter in the ask MCP tool is manipulated to inject shell commands. The issue arises because the parameter is appended to command arguments without proper escaping or validation, allowing arbitrary OS command execution with the server's privileges.

Detection Guidance

To detect this vulnerability, inspect the codex_mcp server for the ask MCP tool. Check if the model parameter is passed directly to a shell command without validation. Look for usage of execAsync or similar functions with unsanitized input. Test by sending a crafted JSON-RPC request with a malicious model parameter to see if arbitrary commands execute.

Impact Analysis

An attacker with local access could execute arbitrary commands on the system running the codex_mcp tool. This could lead to unauthorized data access, system compromise, or further network infiltration depending on the server's permissions. The attack requires local access but could have severe consequences if exploited.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations using this tool may fail compliance audits if exploited, potentially resulting in legal penalties or data breach notifications.

Mitigation Strategies

Immediately restrict the model parameter to a strict allowlist of supported model IDs. Replace shell-string concatenation with safe argument-array APIs like spawn or execFile. Avoid using exec or execAsync with user-controlled input. Update the code to validate and sanitize all inputs before passing them to command execution functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19329. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart