OpenAI Codex CLI and Desktop automatically read the local ".git/config" of any repository that is opened or used. If that configuration includes a malicious core.fsmonitor entry, Git will invoke the specified filesystem‑monitor helper outside the Codex sandbox and without any user‑approval prompt. The helper then runs with the user’s own privileges, enabling the attacker to read, modify, or delete the user’s files or otherwise compromise the host. This configuration‑based remote code execution is a form of CWE-15. Exploitation requires a repository that preserves an attacker‑controlled ".git/config"; normal Git clone operations do not retain such settings.

Affected products are OpenAI Codex CLI, Codex Desktop for macOS, Codex Desktop for Windows, and the Microsoft Store package of Codex Desktop. The vendor’s advisory states that the vulnerability exists in releases prior to Codex CLI 0.131.0, Codex Desktop macOS 26.519.22136, and Codex Desktop Windows 26.519.21041 (Microsoft Store package 26.519.2081.0). These thresholds are explicitly listed, indicating that any version earlier than those is affected.

The CVSS score is 7.3, indicating a high‑severity vulnerability. The EPSS score is less than 1 %, suggesting a very low probability of observed exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw allows the attacker to run arbitrary code with the user’s privileges, the potential impact is severe. The likely attack vector is the delivery of a malicious Git repository that retains a core.fsmonitor configuration pointing to an attacker‑controlled helper. Existing Git clones do not contain such configuration, so the attacker must supply a pre‑configured repository or copy an existing repository with the malicious config intact.