CVE-2025-55345CWE-61

Unsafe symlink following in restricted workspace-write sandbox leads to RCE

High · published August 13, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
57.4
In the wild
Unconfirmed
What it is

Using Codex CLI in workspace-write mode inside a malicious context (repo, directory, etc) could lead to arbitrary file overwrite and potentially remote code execution due to symlinks being followed outside the allowed current working directory.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00838 · 57.4th percentile
Weakness
CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2025-08-13T08:55Z
EPSS history
Timeline
  • 13 AUG 08:55Z
    Unsafe symlink following in restricted workspace-write sandbox leads to RCE
    cvelistv5