CVE-2026-19329

MEDIUM 5.3

andreahaku codex_mcp ask MCP Tool codex-process-simple.ts command injection

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in andreahaku codex_mcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/codex-process-simple.ts of the component ask MCP Tool. The manipulation of the argument model results in command injection. The attack requires a local approach. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-77 CWE-74
Vendor	andreahaku
Product	codex_mcp
Published	Aug 9, 2026

Stay Ahead of the Next One

Get instant alerts for andreahaku codex_mcp

Be the first to know when new medium vulnerabilities affecting andreahaku codex_mcp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

andreahaku / codex_mcp

1ff521cc6cc57cfe56ddef946c644b8534771390

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/387163 vuldb.com: https://vuldb.com/vuln/387163/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19329 vuldb.com: https://vuldb.com/submit/865246 github.com: https://github.com/andreahaku/codex_mcp/issues/1 github.com: https://github.com/andreahaku/codex_mcp/

Credits

🔍 gongyanyu03 (VulDB User) VulDB CNA Team