@openai/codex

Codex CLI is a coding agent from OpenAI that runs locally on your computer.

Latest 0.162.1

88%

Total Score

healthy

Active development, broad ownership, and verified provenance outweigh workflow secret-inheritance and archived-action findings.

Are you affected? Scan for Free

Health Score Breakdown

Version stability

Version 0.162.1 is not a stable major release and 95% of recent releases are prereleases, which signals a rapidly evolving interface and some compatibility risk.

Workflow audit

All 28 workflows were analyzed and all 230 action references are pinned, with no untrusted checkout or script-injection findings. However, high-confidence secrets-inherit findings and one high-confidence archived-uses finding are genuine workflow-hygiene concerns; the low-confidence cache findings do not independently add weight.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-15944 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @openai/codex is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.1.4160940 - 0.151.0.	0.1.4160940 - 0.151.0	Medium
AIKIDO-2026-905742 @openai/codex is vulnerable to Uncontrolled Search Path Element in versions 0.1.4160940 - 0.130.0.	0.1.4160940 - 0.130.0	High
AIKIDO-2026-960660 @openai/codex is vulnerable to External Control of System or Configuration Setting in versions 0.1.4160940 - 0.130.0.	0.1.4160940 - 0.130.0	High
AIKIDO-2026-730721 @openai/codex is vulnerable to Improper Neutralization of Escape in versions 0.1.4160940 - 0.130.0.	0.1.4160940 - 0.130.0	High
AIKIDO-2026-576243 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @openai/codex is vulnerable to Protection Mechanism Failure in versions 0.1.4160940 - 0.142.1.	0.1.4160940 - 0.142.1	Medium