Codex read PowerShell’s stop-parsing token differently to PowerShell, and approval was skipped

What happened

OpenAI, acting as its own CVE numbering authority, recorded that Codex misclassified certain PowerShell commands as safe because its command-safety parser read the stop-parsing token (--%) differently to PowerShell itself. A user who opened an attacker-prepared repository could have Codex run a file-writing Git command with no approval, and if that write reached Codex’s own configuration it could load a malicious MCP server.

This is a parser-differential bug, the same class as the sandbox and gate bypasses already on this board: two components read one string and disagree, and the safety decision is made by the one that is wrong. CVSS 3.1 scores it 8.8 high. The fix, in pull request 22643, treats PowerShell stop-parsing forms as unsupported rather than trying to match the shell’s behaviour, which is the right direction when a parser cannot be trusted to agree.