CVE-2025-54558 — MEDIUM (CVSS 4.1) AI Security Vulnerability

CISO Take

OpenAI Codex CLI versions before 0.9.0 auto-approve ripgrep execution without validating dangerous flags like --pre, which allows arbitrary command execution outside the intended sandboxed approval workflow. Any developer team using Codex CLI for agentic coding tasks on local systems is exposed. Upgrade to 0.9.0 immediately and audit any CI/CD pipelines or developer workstations running the CLI.

Risk Assessment

Despite a moderate CVSS score (4.1), contextual risk is elevated for organizations using AI coding agents. The --pre flag in ripgrep allows specifying a preprocessor binary executed against each file, effectively enabling arbitrary command execution. Since Codex CLI auto-approves rg as a trusted tool, this bypasses the human approval gate that is the primary security control in agentic CLI workflows. Local access and user interaction are required, limiting mass exploitation, but insider threat and supply chain scenarios (malicious repo with crafted .ripgreprc or Makefile) are realistic.

Severity & Risk

CVSS 3.1

4.1 / 10

EPSS

0.0%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

Attack Surface

AV Local

AC High

PR None

UI Required

S Changed

C Low

I Low

A None

Recommended Action

6 steps

Upgrade OpenAI Codex CLI to version 0.9.0 or later immediately.
Audit CI/CD pipelines for pinned Codex CLI versions below 0.9.0.
If immediate upgrade is not possible, disable or restrict ripgrep execution in Codex CLI configuration.
Review any .ripgreprc files in project repositories for presence of --pre, --hostname-bin, or --search-zip flags.
Apply principle of least privilege to the user account running Codex CLI.
In EDR/endpoint telemetry, alert on rg processes spawning child processes or network connections, which would indicate --pre exploitation.

CISA SSVC Assessment

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Code Execution Auth Bypass Agent Plugin AML.T0011.002 - Poisoned AI Agent Tool AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Compliance Impact

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

GOVERN-1.7 - Processes for AI risk management

OWASP LLM Top 10

LLM06 - Excessive Agency LLM07 - System Prompt Leakage / Insecure Plugin Design

Frequently Asked Questions

What is CVE-2025-54558?

OpenAI Codex CLI versions before 0.9.0 auto-approve ripgrep execution without validating dangerous flags like --pre, which allows arbitrary command execution outside the intended sandboxed approval workflow. Any developer team using Codex CLI for agentic coding tasks on local systems is exposed. Upgrade to 0.9.0 immediately and audit any CI/CD pipelines or developer workstations running the CLI.

Is CVE-2025-54558 actively exploited?

No confirmed active exploitation of CVE-2025-54558 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-54558?

1. Upgrade OpenAI Codex CLI to version 0.9.0 or later immediately. 2. Audit CI/CD pipelines for pinned Codex CLI versions below 0.9.0. 3. If immediate upgrade is not possible, disable or restrict ripgrep execution in Codex CLI configuration. 4. Review any .ripgreprc files in project repositories for presence of --pre, --hostname-bin, or --search-zip flags. 5. Apply principle of least privilege to the user account running Codex CLI. 6. In EDR/endpoint telemetry, alert on rg processes spawning child processes or network connections, which would indicate --pre exploitation.

What systems are affected by CVE-2025-54558?

This vulnerability affects the following AI/ML architecture patterns: AI coding assistants, agent frameworks, agentic developer tools.

What is the CVSS score for CVE-2025-54558?

CVE-2025-54558 has a CVSS v3.1 base score of 4.1 (MEDIUM). The EPSS exploitation probability is 0.02%.

Technical Details

NVD Description

OpenAI Codex CLI before 0.9.0 auto-approves ripgrep (aka rg) execution even with the --pre or --hostname-bin or --search-zip or -z flag.

Exploitation Scenario

An adversary plants a malicious .ripgreprc config file in a target repository (e.g., via a compromised dependency or malicious PR). When a developer uses Codex CLI to analyze the repo, the agent invokes ripgrep for file search operations. Because ripgrep is auto-approved, the CLI executes rg with the attacker-controlled --pre flag pointing to a malicious script. The preprocessor script runs with the developer's privileges, enabling credential theft (AWS keys, GitHub tokens, .env files), data exfiltration, or persistence installation—all without triggering the interactive approval prompt that is the CLI's primary defense.