CVE-2026-14898
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The OpenAI Codex desktop app for macOS automatically fetched remote images from model responses, allowing an attacker to inject an indirect prompt into content processed by Codex. The attacker could craft an image URL containing sensitive data, which was sent to an attacker-controlled server without user interaction. This vulnerability enabled exfiltration of secrets, API keys, source code, and data from connected tools.
Risk Assessment
The risk for the organization is the potential exfiltration of confidential data, such as API keys, source code, and results from connected tools, without user awareness. An attacker can exploit this vulnerability to steal sensitive information processed in the Codex session.
Recommendation
It is recommended to immediately update the OpenAI Codex application to the latest version that fixes this vulnerability. Until the update, avoid processing untrusted content in Codex and restrict access to the application.
Original NVD description (English source)
The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image URL containing sensitive data. The app automatically fetched that URL when rendering the response, sending the embedded data to an attacker-controlled server without a separate user click. Successful exploitation could exfiltrate secrets and other information accessible in the Codex session, including API keys, source code, and data returned by connected tools. No direct integrity or availability impact was demonstrated, and there is no known exploitation in the wild.