Description
OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.
Published: 2026-09-01
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Local Execution with User Privileges
Action: Patch Immediately
AI Analysis

Impact

OpenAI Codex Desktop for macOS and Windows automatically inspects Git metadata when a workspace is opened. If a repository contains attacker‑controlled ".git/config" with a vulnerable "attr.tree" setting and a configured clean or process filter, Git can execute an attacker‑supplied program. The program runs outside Codex’s sandbox with the user’s privileges, enabling the attacker to read, modify, or delete files and access user credentials. The vulnerability is a classic example of improper control of code generation and configuration, as documented by CWE-15.

Affected Systems

Affected systems include OpenAI Codex Desktop for macOS and Windows releases that perform automatic inspection of Git metadata on workspace load. Versions older than the patched releases—macOS before 26.519.22136 and Windows before 26.519.21041 (or Microsoft Store 26.519.2081.0)—remain vulnerable. These installations must retain an unmodified .git/config directory within the loaded workspace in order to trigger the flaw.

Risk and Exploitability

The flaw allows an attacker to run code with the signed‑in user’s privileges when they open a specially crafted workspace, representing a high‑severity local execution risk. Exploitation requires the user to open the infected repository and for Git to be available on the system PATH; it is not a passive or remote attack. The EPSS score is less than 1%, signifying a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Prompt patching is advised to mitigate this risk.

Generated by OpenCVE AI on September 3, 2026 at 14:53 UTC.

Remediation

Vendor Solution

Update Codex Desktop for macOS to application version 26.519.22136 or later, or Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or later.

Vendor Workaround

Until updated, do not open attacker-supplied workspace folders that retain untrusted .git metadata.

OpenCVE Recommended Actions

  • Apply the specified vendor patch: update Codex Desktop for macOS to version 26.519.22136 or later, or update Codex Desktop for Windows to application version 26.519.21041 (or Microsoft Store package 26.519.2081.0) or later.
  • Until a patch is applied, avoid opening attacker‑supplied workspace folders that retain untrusted .git metadata.
  • Ensure that Git is not freely available in the system PATH, or restrict Git execution by disabling the clean or process filter settings in the repository configuration.

Generated by OpenCVE AI on September 3, 2026 at 14:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://openai.com/codex cve-icon cve-icon
History

Thu, 03 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Title Code Injection via Untrusted Git Repository in OpenAI Codex Desktop

Wed, 02 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Openai
Openai codex Desktop
Openai codex Desktop (microsoft Store Package)
Vendors & Products Openai
Openai codex Desktop
Openai codex Desktop (microsoft Store Package)

Wed, 02 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
Title Code Injection via Untrusted Git Repository in OpenAI Codex Desktop

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.
Weaknesses CWE-15
References

Subscriptions

Openai Codex Desktop Codex Desktop (microsoft Store Package)
cve-icon MITRE

Status: PUBLISHED

Assigner: OAI

Published:

Updated: 2026-09-02T17:19:30.681Z

Reserved: 2026-08-12T03:54:42.487Z

Link: CVE-2026-19593

cve-icon Vulnrichment

Updated: 2026-09-02T17:19:11.031Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-01T18:17:40.480

Modified: 2026-09-02T18:19:16.337

Link: CVE-2026-19593

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T15:00:06Z

Weaknesses
  • CWE-15

    External Control of System or Configuration Setting