OpenAI Codex CLI and Codex Desktop are vulnerable because their command‑safety parser incorrectly treats PowerShell's stop‑parsing token (--%) as indicating safe input. This misclassification allows an attacker‑prepared repository to contain PowerShell commands that are executed without explicit user approval. The attacker can then trigger a file‑writing Git operation that modifies the Codex configuration files. If Codex later loads the tampered configuration, it can launch an attacker‑controlled MCP server and execute arbitrary code with the full privileges of the user who ran Codex, enabling read, modification, or deletion of any files accessible to that account.

Any OpenAI Codex installation on Windows, macOS, or Linux that has not been upgraded to the patched releases is affected. On Windows, Codex CLI versions prior to 0.131.0 and Codex Desktop application versions earlier than 26.519.22136 (macOS) or 26.519.21041 (Windows) carry the flaw. On macOS and Linux, exploitation additionally requires PowerShell Core (pwsh) to be installed separately. All other versions or operating systems not listed are not affected.

The vulnerability can be leveraged locally by an attacker who deceives a user into opening a malicious repository. The exploitation path requires the attacker to supply a malicious repository and rely on Codex automatically following its instructions. Because the attack is user‑initiated, the likelihood of exploitation in the wild is limited to environments where users regularly open untrusted repositories. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, so the current public exploitation probability is uncertain. Nevertheless, if the attack succeeds, it grants the attacker full local privilege execution and can compromise the user’s entire file system hierarchy, posing a significant risk to confidentiality, integrity, and availability.