CVE-2026-14898

Published Jul 6, 2026

Last updated 2 months ago

CVSS medium 6.5
Chat GPT

Overview

Description
The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image URL containing sensitive data. The app automatically fetched that URL when rendering the response, sending the embedded data to an attacker-controlled server without a separate user click. Successful exploitation could exfiltrate secrets and other information accessible in the Codex session, including API keys, source code, and data returned by connected tools. No direct integrity or availability impact was demonstrated, and there is no known exploitation in the wild.
Source
8f4f43ab-ba69-4d92-aa1d-d772184d6fb7
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
6.5
Impact score
3.6
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Severity
MEDIUM

Weaknesses

8f4f43ab-ba69-4d92-aa1d-d772184d6fb7
CWE-200

Social media

Hype score
Not currently trending

Related CVEs

  1. Linux Kernel Unspecified Vulnerability•CVE-2026-53362
  2. OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins. A cross-site scripting vulnerability in forum.openai.com could be used to access these functions, allowing access to browser history information and the ability to open or close tabs. OpenAI Atlas 1.2025.288.15 narrows access to these APIs to *.chatgpt.com; users should upgrade to 1.2025.288.15 or later.•CVE-2026-11326
  3. Microsoft Defender Denial of Service Vulnerability•CVE-2026-45498
  4. Microsoft Defender Link Following Vulnerability•CVE-2026-41091
  5. A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and .codex/config.toml files without requiring user confirmation, allowing attackers to embed arbitrary commands that execute immediately.•CVE-2025-61260

References

Sources include official advisories and independent security research.