CVE-2026-49134
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
CodexBar before version 0.32.0 contains a privilege escalation vulnerability in the CLI installer, allowing local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges, allowing a local process to overwrite the installer body before the administrator prompt is approved.
Risk Assessment
A local attacker can gain full root privileges, leading to complete system compromise.
Recommendation
Update CodexBar to version 0.32.0 or later, which includes a fix for the vulnerability.
Other vulnerabilities in CodexBar
See all- CVE-2026-49949Medium
A credential forwarding vulnerability in CodexBar before 0.33.0 allows network-adjacent attackers to intercept sensitive credentials via cross-origin or HTTP-downgrade redirects. Attackers can redirect credentialed requests carrying cookies, bearer tokens, or API keys to an unintended host, port, or plaintext HTTP destination.
- CVE-2026-49135High
CodexBar before version 0.32.0 contains an insecure temporary file handling vulnerability. A local attacker can read the App Store Connect API key written to a fixed path, create symbolic links at predictable locations to redirect writes, or tamper with notarization archives before submission.
- CVE-2026-43625Medium
CodexBar before version 0.32.0 contains a session cookie leakage vulnerability, allowing network attackers to intercept imported browser session cookies via improper redirect handling for Amp and Ollama provider sessions.
Original NVD description (English source)
CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installer that allows local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges via bash, allowing a same-user local process to rewrite the installer body before the administrator prompt is approved, causing attacker-controlled commands to run as root.