Description
OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.
Published: 2026-09-01
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Update Codex Desktop for macOS to application version 26.519.22136 or later, or Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or later.

Vendor Workaround

Until updated, do not open attacker-supplied workspace folders that retain untrusted .git metadata.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://openai.com/codex cve-icon cve-icon
History

Wed, 02 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Openai
Openai codex Desktop
Openai codex Desktop (microsoft Store Package)
Vendors & Products Openai
Openai codex Desktop
Openai codex Desktop (microsoft Store Package)

Wed, 02 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
Title Code Injection via Untrusted Git Repository in OpenAI Codex Desktop

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.
Weaknesses CWE-15
References

Subscriptions

Openai Codex Desktop Codex Desktop (microsoft Store Package)
cve-icon MITRE

Status: PUBLISHED

Assigner: OAI

Published:

Updated: 2026-09-02T17:19:30.681Z

Reserved: 2026-08-12T03:54:42.487Z

Link: CVE-2026-19593

cve-icon Vulnrichment

Updated: 2026-09-02T17:19:11.031Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-01T18:17:40.480

Modified: 2026-09-02T18:19:16.337

Link: CVE-2026-19593

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T21:39:17Z

Weaknesses
  • CWE-15

    External Control of System or Configuration Setting