Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was found in andreahaku codex_mcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/codex-process-simple.ts of the component ask MCP Tool. The manipulation of the argument model results in command injection. The attack requires a local approach. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-19329 A vulnerability was found in andreahaku codex_mcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/codex-pr… https://www.cve.org/CVERecord?id=CVE-2026-19329
Post summary
A new CVE (CVE-2026-19329) has been identified in the Andreahaku codex_mcp repository, but the post provides only minimal information about the vulnerability.
🤖 Codex MCP implementation hit by command-injection flaw CVE-2026-19329 affects codex_mcp. Manipulating the model parameter in its MCP ask tool can lead to command injection / elevated execution in a local attack scenario. ⚠️ Technical exploit details are publicly available. 🔎 Source: VulDB. #MCP #Codex #CommandInjection #CVE #CyberSecurity
Post summary
The text announces CVE-2026-19329, describing a command‑injection vulnerability in Codex MCP, with some technical details but no proof‑of‑concept or exploit code provided.