high System graph security Trivy conf 1.00 CVE-2026-40034: gix 0.81.0 — codex-rs/Cargo.lock

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0 ... gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule h…

VulnCve 2026 40034

high System graph security Trivy conf 1.00 CVE-2026-41676: openssl 0.10.75 — codex-rs/Cargo.lock

rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, …

VulnCve 2026 41676

high System graph security Trivy conf 1.00 CVE-2026-41678: openssl 0.10.75 — codex-rs/Cargo.lock

rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reverse…

VulnCve 2026 41678

high System graph security Trivy conf 1.00 CVE-2026-41681: openssl 0.10.75 — codex-rs/Cargo.lock

rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::diges…

VulnCve 2026 41681

high System graph security Trivy conf 1.00 CVE-2026-41898: openssl 0.10.75 — codex-rs/Cargo.lock

rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_c…

VulnCve 2026 41898

high System graph security Trivy conf 1.00 CVE-2026-42327: openssl 0.10.75 — codex-rs/Cargo.lock

rust-openssl: rust-openssl: Arbitrary code execution via specially crafted certificate rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, w…

VulnCve 2026 42327

high System graph security Trivy conf 1.00 CVE-2026-44471: gix-fs 0.19.2 — codex-rs/Cargo.lock

gitoxide is an implementation of git written in Rust. Prior to 0.21.1, ... gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory…

VulnCve 2026 44471

high System graph hardware Supply chain conf 1.00 Dockerfile pipes a remote installer into a shell

Executing downloaded code during image build gives the remote endpoint build-time code execution. Prefer pinned packages or verify downloaded installers by checksum/signature.

.devcontainer/Dockerfile:21 containersRemote installer

high System graph security Trivy conf 1.00 GHSA-3v94-mw7p-v465: hickory-proto 0.25.2 — codex-rs/Cargo.lock

hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses The NSEC3 closest-encloser proof validation in `hickory-proto`'s (0.25.0-alpha.3 ... 0.25.2) and `hickory-net`'s (0.26.0-alpha.1 .. 0.26.0) `DnssecDnsHandle` walks from the QNAME up to the SOA own…

VulnGhsa 3v94 mw7p v465

high System graph security Trivy conf 1.00 GHSA-fr8x-3vfx-f45h: gix 0.81.0 — codex-rs/Cargo.lock

gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository ## **Summary** attachments: [pocs.zip](https://github.com/user-attachments/files/26431422/pocs.zip) Submodule names coming from `.gitmodules` are exposed as unvalidated …

VulnGhsa fr8x 3vfx f45h

high System graph security Trivy conf 1.00 GHSA-p3hw-mv63-rf9w: gix 0.81.0 — codex-rs/Cargo.lock

gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure ### Summary Submodule name validation bypass plus missing validation in production code paths allows path traversal via crafted `.gitmodules`. Combined with a trust inheritance flaw in…

VulnGhsa p3hw mv63 rf9w

high System graph security Trivy conf 1.00 GHSA-p3hw-mv63-rf9w: gix-validate 0.11.0 — codex-rs/Cargo.lock

gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure ### Summary Submodule name validation bypass plus missing validation in production code paths allows path traversal via crafted `.gitmodules`. Combined with a trust inheritance flaw in…

VulnGhsa p3hw mv63 rf9w

high System graph security Trivy conf 1.00 GHSA-pg4w-g64p-qwhj: gix 0.81.0 — codex-rs/Cargo.lock

gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository ## Summary attachments: [pocs.zip](https://github.com/user-attachments/files/26431422/pocs.zip) When `Repository::submodules()` loads submodule metadata, it prefers the worktree `.gitmodules` file if …

VulnGhsa pg4w g64p qwhj

high System graph security Trivy conf 1.00 GHSA-x494-mj8g-cj27: gix-pack 0.68.0 — codex-rs/Cargo.lock

gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data ### Summary Multiple denial-of-service vectors in `gix-pack`: unchecked array indexing causes panics on crafted delta data, and uncapped attacker-controlled size headers enable OOM pro…

VulnGhsa x494 mj8g cj27

high System graph security security conf 1.00 Insecure pattern 'exec_used' in codex-rs/core/src/exec.rs:534

Found a known-risky pattern (exec_used). Review and replace if possible.

codex-rs/core/src/exec.rs:534 Exec used

high System graph security Secrets conf 0.72 Possible secret in codex-rs/model-provider/src/amazon_bedrock/mod.rs

Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager.

codex-rs/model-provider/src/amazon_bedrock/mod.rs:207 Generic api key

high System graph security Secrets conf 0.72 Possible secret in codex-rs/model-provider/src/auth.rs

Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager.

codex-rs/model-provider/src/auth.rs:529 Generic api key

high System graph security Secrets conf 0.72 Possible secret in codex-rs/model-provider/src/provider.rs

Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager.

codex-rs/model-provider/src/provider.rs:484 Generic api key

high System graph security Trivy conf 1.00 Secret leak: Asymmetric Private Key — codex-rs/agent-identity/src/lib.rs

Trivy detected a possible secret in `codex-rs/agent-identity/src/lib.rs`. Rule: private-key Severity: HIGH Match (redacted): **************************************************************** Action: rotate the credential and remove it from the repo. Use a secrets manager or environment variables.

Secret

high System graph security Trivy conf 1.00 Secret leak: Asymmetric Private Key — codex-rs/login/src/auth/agent_identity.rs

Trivy detected a possible secret in `codex-rs/login/src/auth/agent_identity.rs`. Rule: private-key Severity: HIGH Match (redacted): **************************************************************** Action: rotate the credential and remove it from the repo. Use a secrets manager or environment vari…

Secret

high System graph security Skillspector conf 0.70 SkillSpector E2 (data-exfil) in codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py

os.environ.get("GITHUB_TOKEN Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft. Skill: skill-installer Rule: E2 Category: data-exfil Severity: HIGH Confidence: 0.70 Remediation: Avoid reading sensitive env vars (API k…

codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py:12 Mcp skillData exfilE2

high System graph security Skillspector conf 0.95 SkillSpector OH1 (output-handling) in .codex/skills/babysit-pr/scripts/gh_pr_watch.py

subprocess.run(cmd, check=True, capture_output Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution. Skill: babysit-pr Rule: OH1 Category: output-handling Severity: …

.codex/skills/babysit-pr/scripts/gh_pr_watch.py:116 Mcp skillOutput handlingOh1

high System graph security Skillspector conf 0.95 SkillSpector OH1 (output-handling) in .codex/skills/codex-issue-digest/scripts/collect_issue_digest.py

subprocess.run(cmd, check=True, capture_output Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution. Skill: codex-issue-digest Rule: OH1 Category: output-handling Se…

.codex/skills/codex-issue-digest/scripts/collect_issue_digest.py:230 Mcp skillOutput handlingOh1

high System graph security Skillspector conf 0.85 SkillSpector P6 (prompt-injection) in codex-rs/skills/src/assets/samples/imagegen/scripts/image_gen.py

return prompt Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties. Skill: imagegen Rule: P6 Category: prompt-injection Severity: HIGH Confidence: 0.85 Remediation: Remove any instructions that reveal, print,…

codex-rs/skills/src/assets/samples/imagegen/scripts/image_gen.py:88 Mcp skillPrompt injectionP6

high System graph security Skillspector conf 0.85 SkillSpector P6 (prompt-injection) in codex-rs/skills/src/assets/samples/openai-docs/references/upgrade-guide.md

Output rule Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties. Skill: openai-docs Rule: P6 Category: prompt-injection Severity: HIGH Confidence: 0.85 Remediation: Remove any instructions that reveal, print…

codex-rs/skills/src/assets/samples/openai-docs/references/upgrade-guide.md:61 Mcp skillPrompt injectionP6

high System graph security Skillspector conf 0.85 SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/references/installing-and-updating.md

Replace the existing Code Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors. Skill: plugin-creator Rule: RA1 Category: rogue-agent Severity: HIGH Confidence: …

codex-rs/skills/src/assets/samples/plugin-creator/references/installing-and-updating.md:109 Mcp skillRogue agentRa1

high System graph security Skillspector conf 0.85 SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/scripts/create_basic_plugin.py

Overwrite existing file Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors. Skill: plugin-creator Rule: RA1 Category: rogue-agent Severity: HIGH Confidence: 0.…

codex-rs/skills/src/assets/samples/plugin-creator/scripts/create_basic_plugin.py:253 Mcp skillRogue agentRa1

high System graph security Skillspector conf 0.85 SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/skill-creator/scripts/init_skill.py

Edit SKILL Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors. Skill: skill-creator Rule: RA1 Category: rogue-agent Severity: HIGH Confidence: 0.85 Remediatio…

codex-rs/skills/src/assets/samples/skill-creator/scripts/init_skill.py:319 Mcp skillRogue agentRa1

high System graph security Skillspector conf 0.85 SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/skill-creator/SKILL.md

write SKILL Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors. Skill: skill-creator Rule: RA1 Category: rogue-agent Severity: HIGH Confidence: 0.85 Remediati…

codex-rs/skills/src/assets/samples/skill-creator/SKILL.md:230 Mcp skillRogue agentRa1

high System graph security Skillspector conf 0.85 SkillSpector TM1 (tool-misuse) in codex-rs/skills/src/assets/samples/imagegen/references/cli.md

rm -f tmp/imagegen/ Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns). Skill: imagegen Rule: TM1 Category: tool-misuse Severity: HIGH Confidence: 0.85 Remediation: Validate…

codex-rs/skills/src/assets/samples/imagegen/references/cli.md:220 Mcp skillTool misuseTm1

high System graph dependencies dependencies conf 1.00 Vulnerable dependency gix 0.81.0: GHSA-f26g-jm89-4g65

OSV.dev reports `gix` at version `0.81.0` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-f26g-jm89-4g65 (aka CVE-2026-40034). gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules Aliases: CVE-2026-400…

codex-rs/Cargo.toml ScaOsvGhsa f26g jm89 4g65

high System graph dependencies dependencies conf 1.00 Vulnerable dependency gix 0.81.0: GHSA-fr8x-3vfx-f45h

OSV.dev reports `gix` at version `0.81.0` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-fr8x-3vfx-f45h. gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository Advisory: https://osv.dev/vulnerability/GHSA-fr8x-3vfx-…

codex-rs/Cargo.toml ScaOsvGhsa fr8x 3vfx f45h

high System graph dependencies dependencies conf 1.00 Vulnerable dependency gix 0.81.0: GHSA-p3hw-mv63-rf9w

OSV.dev reports `gix` at version `0.81.0` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-p3hw-mv63-rf9w. gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure Advisory: https://osv.dev/vulnerability/GHSA-p3hw-mv63-rf9w Fix: upgra…

codex-rs/Cargo.toml ScaOsvGhsa p3hw mv63 rf9w

high System graph dependencies dependencies conf 1.00 Vulnerable dependency gix 0.81.0: GHSA-pg4w-g64p-qwhj

OSV.dev reports `gix` at version `0.81.0` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-pg4w-g64p-qwhj. gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository Advisory: https://osv.dev/vulnerability/GHSA-pg4w-g64p-qwhj Fix: upgrade `gix` past the…

codex-rs/Cargo.toml ScaOsvGhsa pg4w g64p qwhj

high System graph dependencies dependencies conf 1.00 Vulnerable dependency tar 0.4.44: GHSA-gchp-q4r4-x4ff

OSV.dev reports `tar` at version `0.4.44` (resolved in `tools/argument-comment-lint/Cargo.lock`) is affected by GHSA-gchp-q4r4-x4ff (aka CVE-2026-33055). tar-rs incorrectly ignores PAX size headers if header size is nonzero Aliases: CVE-2026-33055, RUSTSEC-2026-0068 Advisory: https://osv.dev/vuln…

tools/argument-comment-lint/Cargo.lock ScaOsvGhsa gchp q4r4 x4ff

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — codex-rs/skills/src/assets/samples/openai-docs/scripts/fetch-codex-manual.mjs:175

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — codex-rs/skills/src/assets/samples/openai-docs/scripts/resolve-latest-model-info.js:39

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .codex/skills/babysit-pr/agents/openai.yaml

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.codex/skills/babysit-pr/agents/openai.yaml VerificationCodex instruction

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .codex/skills/babysit-pr/references/github-api-notes.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.codex/skills/babysit-pr/references/github-api-notes.md VerificationCodex instruction

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .codex/skills/babysit-pr/references/heuristics.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.codex/skills/babysit-pr/references/heuristics.md VerificationCodex instruction

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .codex/skills/babysit-pr/SKILL.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.codex/skills/babysit-pr/SKILL.md VerificationCodex instruction

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .codex/skills/code-review/SKILL.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.codex/skills/code-review/SKILL.md VerificationCodex instruction

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .codex/skills/codex-issue-digest/agents/openai.yaml

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.codex/skills/codex-issue-digest/agents/openai.yaml VerificationCodex instruction

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .codex/skills/codex-pr-body/SKILL.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.codex/skills/codex-pr-body/SKILL.md VerificationCodex instruction

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .codex/skills/path-types/SKILL.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.codex/skills/path-types/SKILL.md VerificationCodex instruction

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .codex/skills/update-v8-version/SKILL.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

.codex/skills/update-v8-version/SKILL.md VerificationCodex instruction

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: AGENTS.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

AGENTS.md VerificationAgents md

medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing

AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.

Repo hardeningGenerated repo pattern

medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data

A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.

Mock dataCritical flowGenerated repo pattern

medium System graph security Trivy conf 1.00 CVE-2026-25537: jsonwebtoken 9.3.1 — codex-rs/Cargo.lock

jsonwebtoken: jsonwebtoken has Type Confusion that leads to potential authorization bypass jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim (such as nbf or exp) is…

VulnCve 2026 25537

medium System graph security Trivy conf 1.00 CVE-2026-33055: tar 0.4.44 — tools/argument-comment-lint/Cargo.lock

tar-rs is a tar archive reading/writing library for Rust. Versions 0.4 ... tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral…

VulnCve 2026 33055

medium System graph security Trivy conf 1.00 CVE-2026-33056: tar 0.4.44 — tools/argument-comment-lint/Cargo.lock

tar-rs: tar-rs: Arbitrary directory permission modification via crafted tar archive tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exi…

VulnCve 2026 33056

medium System graph security Trivy conf 1.00 CVE-2026-44662: openssl 0.10.75 — codex-rs/Cargo.lock

rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.0 to before 0.10.79, CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update incorrectly sized output buffe…

VulnCve 2026 44662

medium System graph security Trivy conf 1.00 CVE-2026-45784: openssl 0.10.75 — codex-rs/Cargo.lock

rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-…

VulnCve 2026 45784

medium System graph security Trivy conf 1.00 CVE-2026-48504: opentelemetry_sdk 0.31.0 — codex-rs/Cargo.lock

opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce W3C Baggage size limits before parsing an inbound baggage he…

VulnCve 2026 48504

medium System graph security Trivy conf 1.00 CVE-2026-50185: cmov 0.5.3 — codex-rs/Cargo.lock

RustCrypto CMOV provides conditional move CPU intrinsics which are gua ... RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementati…

VulnCve 2026 50185

medium System graph security Trivy conf 1.00 DS-0013: 'RUN cd ...' to change directory — .devcontainer/Dockerfile.secure

'RUN cd ...' to change directory RUN should not be used to change directory: 'curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - && apt-get update && apt-get install -y --no-install-recommends nodejs && test "$(node -p "require('/opt/codex-install/package.json').dep…

Misconfig

medium System graph security Semgrep conf 1.00 dynamic urllib use detected — codex-rs/scripts/write_model_compatibility_catalog.py:22

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…

SecurityPython

medium System graph security Semgrep conf 1.00 dynamic urllib use detected — codex-rs/scripts/write_provider_catalog.py:191

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…

SecurityPython

medium System graph security Semgrep conf 1.00 dynamic urllib use detected — codex-rs/scripts/write_provider_catalog.py:35

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…

SecurityPython

medium System graph security Semgrep conf 1.00 dynamic urllib use detected — codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py:16

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…

SecurityPython

medium System graph security Semgrep conf 1.00 dynamic urllib use detected — scripts/codex_package/dotslash.py:170

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…

SecurityPython

medium System graph security Semgrep conf 1.00 dynamic urllib use detected — scripts/codex_package/v8.py:175

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…

SecurityPython

medium System graph security Semgrep conf 1.00 dynamic urllib use detected — sdk/python/_runtime_setup.py:154

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…

SecurityPython

medium System graph security Semgrep conf 1.00 dynamic urllib use detected — sdk/python/_runtime_setup.py:182

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…

SecurityPython

medium System graph security Semgrep conf 1.00 dynamic urllib use detected — sdk/python/_runtime_setup.py:214

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…

SecurityPython

medium System graph security Trivy conf 1.00 GHSA-3pv8-6f4r-ffg2: tar 0.4.44 — tools/argument-comment-lint/Cargo.lock

tar has a PAX header desynchronization issue ### Summary When a tar stream contains multiple "header" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would…

VulnGhsa 3pv8 6f4r ffg2

medium System graph security Trivy conf 1.00 GHSA-3pv8-6f4r-ffg2: tar 0.4.45 — codex-rs/Cargo.lock

tar has a PAX header desynchronization issue ### Summary When a tar stream contains multiple "header" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would…

VulnGhsa 3pv8 6f4r ffg2

medium System graph security Trivy conf 1.00 GHSA-9857-6mw7-fq2m: gix-transport 0.55.1 — codex-rs/Cargo.lock

gix-transport: HTTP credentials leaked to redirected host in curl backend ## Summary The curl-based HTTP transport in `gix-transport` sends user credentials (passwords, tokens) to an attacker-controlled server after an HTTP redirect. When a server responds with a 302 redirect during the initial `…

VulnGhsa 9857 6mw7 fq2m

medium System graph security Trivy conf 1.00 GHSA-q2qq-hmj6-3wpp: hickory-proto 0.25.2 — codex-rs/Cargo.lock

hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n²) name compression During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`. The name compression logic then searches for mat…

VulnGhsa q2qq hmj6 3wpp

medium System graph security Trivy conf 1.00 GHSA-xhj4-vrgc-hr34: actix-http 3.11.2 — codex-rs/Cargo.lock

actix-http has HTTP/1.1 CL.TE Request Smuggling A vulnerability in `actix-http`'s HTTP/1.1 request parser allows an unauthenticated remote client to smuggle requests in deployments where a front-end HTTP intermediary and the Actix backend disagree about whether `Content-Length` or `Transfer-Encod…

VulnGhsa xhj4 vrgc hr34

medium System graph cicd CI/CD security conf 1.00 6 occurrences GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

6 files, 6 locations

.github/workflows/python-runtime-release.yml

.github/workflows/python-sdk-release.yml

.github/workflows/rust-release-prepare.yml

.github/workflows/rust-release-publish-existing.yml

.github/workflows/rust-release.yml

.github/workflows/rusty-v8-release.yml

CI/CD securitySupply chainGithub actions

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — .github/scripts/run_bazel_with_buildbuddy.py:210

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — .github/scripts/rusty_v8_bazel.py:33

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — .github/scripts/v8_canary_changes.py:117

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — codex-cli/scripts/build_npm_package.py:329

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py:16

`urllib.request.urlopen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — codex-rs/skills/src/assets/samples/skill-installer/scripts/install-skill-from-github.py:100

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — codex-rs/windows-sandbox-rs/sandbox_smoketests.py:130

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/check_blob_size.py:25

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/codex_package/cargo.py:81

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/format.py:52

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/just-shell.py:57

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — scripts/stage_npm_packages.py:150

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — sdk/python/_runtime_setup.py:126

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — sdk/python/scripts/update_sdk_artifacts.py:65

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

runtime safetyRobustness

medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected

Found 488 placeholder/mock markers across 104 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.

Mock dataIncompleteGenerated repo pattern

medium System graph quality Placeholder conf 1.00 Runtime service client appears to use placeholder configuration

A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured.

Runtime configService clientGenerated repo pattern

medium System graph security Trivy conf 1.00 Secret leak: JWT token — codex-rs/model-provider/src/auth.rs

Trivy detected a possible secret in `codex-rs/model-provider/src/auth.rs`. Rule: jwt-token Severity: MEDIUM Match (redacted): EST_CHATGPT_ID_TOKEN: &str = "************************************************** Action: rotate the credential and remove it from the repo. Use a secrets manager or enviro…

Secret

medium System graph security Skillspector conf 0.60 SkillSpector AST4 (behavioral-ast) in .codex/skills/babysit-pr/scripts/gh_pr_watch.py

proc = subprocess.run(cmd, check=True, capture_output=True, text=True) subprocess module calls execute external commands. Without careful input validation, this enables command injection. Skill: babysit-pr Rule: AST4 Category: behavioral-ast Severity: MEDIUM Confidence: 0.60 Remediation: Use s…

.codex/skills/babysit-pr/scripts/gh_pr_watch.py:116 Mcp skillBehavioral astAst4

medium System graph security Skillspector conf 0.60 SkillSpector AST4 (behavioral-ast) in .codex/skills/codex-issue-digest/scripts/collect_issue_digest.py

proc = subprocess.run(cmd, check=True, capture_output=True, text=True) subprocess module calls execute external commands. Without careful input validation, this enables command injection. Skill: codex-issue-digest Rule: AST4 Category: behavioral-ast Severity: MEDIUM Confidence: 0.60 Remediatio…

.codex/skills/codex-issue-digest/scripts/collect_issue_digest.py:230 Mcp skillBehavioral astAst4

medium System graph security Skillspector conf 0.60 SkillSpector AST4 (behavioral-ast) in codex-rs/skills/src/assets/samples/skill-installer/scripts/install-skill-from-github.py

result = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True) subprocess module calls execute external commands. Without careful input validation, this enables command injection. Skill: skill-installer Rule: AST4 Category: behavioral-ast Severity: MEDIUM Confidence: 0…

codex-rs/skills/src/assets/samples/skill-installer/scripts/install-skill-from-github.py:100 Mcp skillBehavioral astAst4

medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in .codex/skills/codex-bug/SKILL.md

https://api.github.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: codex-bug Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted and necessar…

.codex/skills/codex-bug/SKILL.md:23 Mcp skillData exfilE1

medium System graph security Skillspector conf 0.50 SkillSpector E1 (data-exfil) in codex-rs/skills/src/assets/samples/skill-creator/references/openai_yaml.md

https://api.githubcopilot.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: skill-creator Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.50 Remediation: Verify the destination URL is trusted a…

codex-rs/skills/src/assets/samples/skill-creator/references/openai_yaml.md:22 Mcp skillData exfilE1

medium System graph security Skillspector conf 0.60 SkillSpector E1 (data-exfil) in codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py

https://api.github.com/ Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended. Skill: skill-installer Rule: E1 Category: data-exfil Severity: MEDIUM Confidence: 0.60 Remediation: Verify the destination URL is trusted and ne…

codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py:21 Mcp skillData exfilE1

medium System graph security Skillspector conf 0.75 SkillSpector EA2 (excessive-agency) in .codex/skills/babysit-pr/SKILL.md

without asking Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation. Skill: babysit-pr Rule: EA2 Category: excessive-agency Severity: MEDI…

.codex/skills/babysit-pr/SKILL.md:201 Mcp skillExcessive agencyEa2

medium System graph security Skillspector conf 0.80 SkillSpector EA2 (excessive-agency) in codex-rs/skills/src/assets/samples/imagegen/SKILL.md

Do not ask the user Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation. Skill: imagegen Rule: EA2 Category: excessive-agency Severity: M…

codex-rs/skills/src/assets/samples/imagegen/SKILL.md:334 Mcp skillExcessive agencyEa2

medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in .codex/skills/babysit-pr/SKILL.md

MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: babysit-pr Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.

.codex/skills/babysit-pr/SKILL.md:1 Mcp skillMcp least privLp3

medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in .codex/skills/codex-issue-digest/SKILL.md

MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: codex-issue-digest Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.

.codex/skills/codex-issue-digest/SKILL.md:1 Mcp skillMcp least privLp3

medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/imagegen/SKILL.md

MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: imagegen Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.

codex-rs/skills/src/assets/samples/imagegen/SKILL.md:1 Mcp skillMcp least privLp3

medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/openai-docs/SKILL.md

MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: openai-docs Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.

codex-rs/skills/src/assets/samples/openai-docs/SKILL.md:1 Mcp skillMcp least privLp3

medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md

MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: plugin-creator Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.

codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md:1 Mcp skillMcp least privLp3

medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/skill-creator/SKILL.md

MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: skill-creator Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.

codex-rs/skills/src/assets/samples/skill-creator/SKILL.md:1 Mcp skillMcp least privLp3

medium System graph security Skillspector conf 0.70 SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/skill-installer/SKILL.md

MCP Least Privilege Without declared permissions the skill's intent is opaque and cannot be validated. Skill: skill-installer Rule: LP3 Category: mcp-least-priv Severity: MEDIUM Confidence: 0.70 Remediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires.

codex-rs/skills/src/assets/samples/skill-installer/SKILL.md:1 Mcp skillMcp least privLp3

medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md

Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, valid manifest defaults, and personal-marketplace entries by default. Use w Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or sta…

codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md:3 Mcp skillRogue agentRa2

medium System graph security Skillspector conf 0.60 SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/skill-creator/SKILL.md

create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. metadata: short-description: Create or update a skill Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or stat…

codex-rs/skills/src/assets/samples/skill-creator/SKILL.md:3 Mcp skillRogue agentRa2

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency actix-http 3.11.2: GHSA-xhj4-vrgc-hr34

OSV.dev reports `actix-http` at version `3.11.2` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-xhj4-vrgc-hr34. Note: `actix-http` is a transitive dependency — pulled in by another package, not declared directly in a manifest. actix-http has HTTP/1.1 CL.TE Request Smuggling Advisory: htt…

codex-rs/Cargo.lock ScaOsvGhsa xhj4 vrgc hr34

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190

OSV.dev reports `anyhow` at version `1.0.102` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2026-0190. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2026-0190 Fix: upgrade `anyhow` past the affected range per the advisory.

codex-rs/Cargo.toml ScaOsvRustsec 2026 0190

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atomic-polyfill 1.0.3: RUSTSEC-2023-0089

OSV.dev reports `atomic-polyfill` at version `1.0.3` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2023-0089. Note: `atomic-polyfill` is a transitive dependency — pulled in by another package, not declared directly in a manifest. atomic-polyfill is unmaintained Advisory: https://osv.…

codex-rs/Cargo.lock ScaOsvRustsec 2023 0089

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency bincode 1.3.3: RUSTSEC-2025-0141

OSV.dev reports `bincode` at version `1.3.3` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2025-0141. Note: `bincode` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Bincode is unmaintained Advisory: https://osv.dev/vulnerability/RUSTSE…

codex-rs/Cargo.lock ScaOsvRustsec 2025 0141

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency cmov 0.5.3: GHSA-3rjw-m598-pq24

OSV.dev reports `cmov` at version `0.5.3` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-3rjw-m598-pq24 (aka CVE-2026-50185). Note: `cmov` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Cmov/CmovEq on aarch64 can produce wrong results if hi…

codex-rs/Cargo.lock ScaOsvGhsa 3rjw m598 pq24

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency cxx 1.0.194: RUSTSEC-2026-0202

OSV.dev reports `cxx` at version `1.0.194` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2026-0202. Note: `cxx` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-20…

codex-rs/Cargo.lock ScaOsvRustsec 2026 0202

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency derivative 2.2.0: RUSTSEC-2024-0388

OSV.dev reports `derivative` at version `2.2.0` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2024-0388. Note: `derivative` is a transitive dependency — pulled in by another package, not declared directly in a manifest. `derivative` is unmaintained; consider using an alternative Advi…

codex-rs/Cargo.lock ScaOsvRustsec 2024 0388

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency jsonwebtoken 9.3.1: GHSA-h395-gr6q-cpjc

OSV.dev reports `jsonwebtoken` at version `9.3.1` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-h395-gr6q-cpjc (aka CVE-2026-25537). jsonwebtoken has Type Confusion that leads to potential authorization bypass Aliases: CVE-2026-25537 Advisory: https://osv.dev/vulnerability/GHSA-h395-gr6…

codex-rs/Cargo.toml ScaOsvGhsa h395 gr6q cpjc

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency lru 0.12.5: GHSA-rhfx-m35p-ff5j

OSV.dev reports `lru` at version `0.12.5` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-rhfx-m35p-ff5j. `IterMut` violates Stacked Borrows by invalidating internal pointer Aliases: RUSTSEC-2026-0002 Advisory: https://osv.dev/vulnerability/GHSA-rhfx-m35p-ff5j Fix: upgrade `lru` past the …

codex-rs/Cargo.lock ScaOsvGhsa rhfx m35p ff5j

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency opentelemetry_sdk 0.31.0: GHSA-w9wp-h8wv-79jx

OSV.dev reports `opentelemetry_sdk` at version `0.31.0` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-w9wp-h8wv-79jx (aka CVE-2026-48504). opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation Aliases: CVE-2026-48504 Advisory: https://osv.dev/vulnerability/GHSA-w9…

codex-rs/Cargo.toml ScaOsvGhsa w9wp h8wv 79jx

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0194

OSV.dev reports `quick-xml` at version `0.39.4` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2026-0194. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2026-0194 Fix: upgrade `quick-xml` past the affected range per the advisory.

codex-rs/Cargo.lock ScaOsvRustsec 2026 0194

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0195

OSV.dev reports `quick-xml` at version `0.39.4` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2026-0195. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2026-0195 Fix: upgrade `quick-xml` past the affected range per the advisory.

codex-rs/Cargo.lock ScaOsvRustsec 2026 0195

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency tar 0.4.44: GHSA-3pv8-6f4r-ffg2

OSV.dev reports `tar` at version `0.4.44` (resolved in `tools/argument-comment-lint/Cargo.lock`) is affected by GHSA-3pv8-6f4r-ffg2. tar has a PAX header desynchronization issue Advisory: https://osv.dev/vulnerability/GHSA-3pv8-6f4r-ffg2 Fix: upgrade `tar` past the affected range per the advisory.

tools/argument-comment-lint/Cargo.lock ScaOsvGhsa 3pv8 6f4r ffg2

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency tar 0.4.44: GHSA-j4xf-2g29-59ph

OSV.dev reports `tar` at version `0.4.44` (resolved in `tools/argument-comment-lint/Cargo.lock`) is affected by GHSA-j4xf-2g29-59ph (aka CVE-2026-33056). tar-rs `unpack_in` can chmod arbitrary directories by following symlinks Aliases: CVE-2026-33056, RUSTSEC-2026-0067 Advisory: https://osv.dev/v…

tools/argument-comment-lint/Cargo.lock ScaOsvGhsa j4xf 2g29 59ph

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency tar 0.4.45: GHSA-3pv8-6f4r-ffg2

OSV.dev reports `tar` at version `0.4.45` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-3pv8-6f4r-ffg2. tar has a PAX header desynchronization issue Advisory: https://osv.dev/vulnerability/GHSA-3pv8-6f4r-ffg2 Fix: upgrade `tar` past the affected range per the advisory.

codex-rs/Cargo.toml ScaOsvGhsa 3pv8 6f4r ffg2

low System graph quality Maintenance conf 1.00 136 TODO/FIXME markers

High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.

low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

Deployment

low System graph security Trivy conf 1.00 CVE-2026-41677: openssl 0.10.75 — codex-rs/Cargo.lock

rust-openssl provides OpenSSL bindings for the Rust programming langua ... rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that ret…

VulnCve 2026 41677

low System graph quality Debug conf 1.00 Debug logging residue appears in source files

Found 373 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.

CleanupRepo hardeningGenerated repo pattern

low System graph dependencies dependencies conf 0.90 Dependency agent-client-protocol is a major version behind

`agent-client-protocol` is pinned at `0.12.1` in `codex-rs/acp-server/Cargo.toml` while the latest release on the cargo registry is `1.3.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrad…

codex-rs/acp-server/Cargo.toml FreshnessOutdated

low System graph dependencies dependencies conf 0.90 Dependency ansi-to-tui is a major version behind

`ansi-to-tui` is pinned at `7.0.0` in `codex-rs/ansi-escape/Cargo.toml` while the latest release on the cargo registry is `8.0.1` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `ansi-to…

codex-rs/ansi-escape/Cargo.toml FreshnessOutdated

low System graph dependencies dependencies conf 0.90 Dependency chardetng is a major version behind

`chardetng` is pinned at `0.1.17` in `codex-rs/protocol/Cargo.toml` while the latest release on the cargo registry is `1.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `chardetng` …

codex-rs/protocol/Cargo.toml FreshnessOutdated

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: ubuntu:24.04

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

.devcontainer/Dockerfile:1 containersPinned dependencies

low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — .devcontainer/Dockerfile

No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: .devcontainer/Dockerfile

Misconfig

low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — .devcontainer/Dockerfile.secure

No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: .devcontainer/Dockerfile.secure

Misconfig

low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — .github/workflows/Dockerfile.bazel

No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: .github/workflows/Dockerfile.bazel

Misconfig

low System graph security Trivy conf 1.00 GHSA-rhfx-m35p-ff5j: lru 0.12.5 — codex-rs/Cargo.lock

`IterMut` violates Stacked Borrows by invalidating internal pointer Affected versions of this crate contain a soundness issue in the `IterMut` iterator implementation. The `IterMut::next` and `IterMut::next_back` methods temporarily create an exclusive reference to the key when dereferencing the i…

VulnGhsa rhfx m35p ff5j

low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 2 places

Functions with the same first-5-line body hash: codex-rs/windows-sandbox-rs/sandbox_smoketests.py:do_GET, codex-rs/windows-sandbox-rs/sandbox_smoketests.py:do_GET This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or docum…

duplicatesduplication

low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 4 places

Functions with the same first-5-line body hash: sdk/python/src/openai_codex/client.py:request, sdk/python/src/openai_codex/client.py:request_with_retry_on_overload, sdk/python/src/openai_codex/async_client.py:request, sdk/python/src/openai_codex/async_client.py:request_with_retry_on_overload This …

duplicatesduplication

low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: sdk/typescript/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

sdk/typescript/package.json LockfileReproducibilityGenerated repo pattern

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in sdk/python/src/openai_codex/_goal.py:214

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `pydantic_v2` in sdk/python/scripts/update_sdk_artifacts.py:595

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `upgrade_copy` in sdk/python/src/openai_codex/generated/v2_all.py:2118

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

old markerDead code

low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts

preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.

sdk/typescript/package.json CI/CD securitySupply chainNpm

low System graph software Dead code conf 1.00 Possibly dead Python function: active_turn

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/src/openai_codex/_goal.py:154

low System graph software Dead code conf 1.00 Possibly dead Python function: begin_interrupt

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/src/openai_codex/_goal.py:130

low System graph software Dead code conf 1.00 Possibly dead Python function: cancel_interrupt

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/src/openai_codex/_goal.py:143

low System graph software Dead code conf 1.00 Possibly dead Python function: cleanup_cancelled_start

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/src/openai_codex/async_client.py:260

low System graph software Dead code conf 1.00 Possibly dead Python function: confirm_interrupt

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/src/openai_codex/_goal.py:137

low System graph software Dead code conf 1.00 Possibly dead Python function: current_sdk_version

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/scripts/update_sdk_artifacts.py:72

low System graph software Dead code conf 1.00 Possibly dead Python function: default_codex_home

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/src/openai_codex/client.py:863

low System graph software Dead code conf 1.00 Possibly dead Python function: handler

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

scripts/mock_responses_websocket_server.py:143

low System graph software Dead code conf 1.00 Possibly dead Python function: install_single_binary

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

scripts/stage_npm_packages.py:391

low System graph software Dead code conf 1.00 Possibly dead Python function: install_single_codex_package_archive

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

scripts/stage_npm_packages.py:340

low System graph software Dead code conf 1.00 Possibly dead Python function: login_chatgpt_device_code

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/src/openai_codex/api.py:356

low System graph software Dead code conf 1.00 Possibly dead Python function: logout

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/src/openai_codex/api.py:366

low System graph software Dead code conf 1.00 Possibly dead Python function: request_with_retry_on_overload

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/src/openai_codex/client.py:671

low System graph software Dead code conf 1.00 Possibly dead Python function: request_with_retry_on_overload

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/src/openai_codex/async_client.py:315

low System graph software Dead code conf 1.00 Possibly dead Python function: resolve_active_turn

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/src/openai_codex/_goal.py:173

low System graph software Dead code conf 1.00 Possibly dead Python function: start_operation

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/src/openai_codex/async_client.py:244

low System graph software Dead code conf 1.00 Possibly dead Python function: stop_cancelled_goal

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

sdk/python/src/openai_codex/async_client.py:268

low System graph security Skillspector conf 0.50 SkillSpector AST7 (behavioral-ast) in codex-rs/skills/src/assets/samples/imagegen/scripts/image_gen.py

val = getattr(exc, attr, None) Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls. Skill: imagegen Rule: AST7 Category: behavioral-ast Severity: LOW Confidence: 0.50 Remediation: Replace dynamic getattr() with expli…

codex-rs/skills/src/assets/samples/imagegen/scripts/image_gen.py:512 Mcp skillBehavioral astAst7

low System graph security Skillspector conf 0.70 SkillSpector EA3 (excessive-agency) in .codex/skills/codex-pr-body/SKILL.md

not limited to Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface. Skill: codex-pr-body Rule: EA3 Category: excessive-agency Severity: LOW Confidence: 0.70 Re…

.codex/skills/codex-pr-body/SKILL.md:22 Mcp skillExcessive agencyEa3

low System graph security Skillspector conf 0.70 SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/imagegen/LICENSE.txt

not limited to Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface. Skill: imagegen Rule: EA3 Category: excessive-agency Severity: LOW Confidence: 0.70 Remedia…

codex-rs/skills/src/assets/samples/imagegen/LICENSE.txt:27 Mcp skillExcessive agencyEa3

low System graph security Skillspector conf 0.70 SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/openai-docs/LICENSE.txt

not limited to Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface. Skill: openai-docs Rule: EA3 Category: excessive-agency Severity: LOW Confidence: 0.70 Reme…

codex-rs/skills/src/assets/samples/openai-docs/LICENSE.txt:27 Mcp skillExcessive agencyEa3

low System graph security Skillspector conf 0.70 SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/skill-creator/license.txt

not limited to Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface. Skill: skill-creator Rule: EA3 Category: excessive-agency Severity: LOW Confidence: 0.70 Re…

codex-rs/skills/src/assets/samples/skill-creator/license.txt:28 Mcp skillExcessive agencyEa3

low System graph security Skillspector conf 0.70 SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/skill-installer/LICENSE.txt

not limited to Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface. Skill: skill-installer Rule: EA3 Category: excessive-agency Severity: LOW Confidence: 0.70 …

codex-rs/skills/src/assets/samples/skill-installer/LICENSE.txt:28 Mcp skillExcessive agencyEa3

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — sdk/typescript/samples/basic_streaming.ts:17

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — sdk/typescript/samples/structured_output.ts:22

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — sdk/typescript/samples/structured_output_zod.ts:19

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph quality Integrity conf 1.00 Stub function `log_message` (body is just `pass`/`return`) — codex-rs/windows-sandbox-rs/sandbox_smoketests.py:146

Likely an AI scaffold that was never filled in. Remove or implement.

Empty handlerDead code

low System graph quality Complexity conf 1.00 Very large file: codex-rs/acp-server/src/lib.rs (1367 lines)