What’s Vulnerable › Vulnerabilities
CVE-2026-19593
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-01 · updated 2026-10-15
- Weakness: CWE-15
Description
OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.
Affected products
- OpenAI Codex Desktop: from 260202.0859 through 26.513.31313; from 26.304.38 through 26.513.40821
- OpenAI Codex Desktop (Microsoft Store package): from 26.304.38.0 through 26.513.4821.0
References
Get alerted when CVE-2026-19593 or the next vulnerability affects your stack