CVE-2026-110930
When a user opened a project from a specially prepared Windows library, affected versions of Codex Desktop could run the attacker's code. The code could run before the user signed in or approved the project.
Affected products & versions
Affected products & versions
| Vendor | Product | Platform | Affected versions |
|---|---|---|---|
| OpenAI | Codex Desktop (application) | Windows | 26.820.60940–26.1002.52244 |
| OpenAI | Codex Desktop (Microsoft Store package) | Windows | 26.820.7780.0–26.1002.7124.0 |
Version ranges are inclusive.
Impact
The attacker could run code with the permissions of the current Windows user.
Conditions
Conditions
Codex Desktop had to be fully closed, with no ChatGPT.exe process running. The user had to open the attacker's .library-ms file in File Explorer on Windows 11 and expand the library in the navigation pane. The user then had to right-click an item under the library and select Open project in ChatGPT from the modern context menu.
Known exploitation
Known exploitation
No known abuse in the wild.
Mitigations
Mitigations
- Update Codex Desktop for Windows to application version 26.1007.21434 (Microsoft Store package 26.1007.2314.0) or a subsequent version.
Vulnerability description
Codex Desktop did not correctly handle quotation marks in project paths from File Explorer. An attacker could put quotation marks in a path to pass extra arguments to Codex Desktop at startup. These arguments could cause the application to run the attacker's code.
Problem type
CWE-88(opens in a new window) — Improper Neutralization of Argument Delimiters in a Command.
Credits
Credits
Ikotas Labs, Inc. (@ikotas00) reported the vulnerability through the Zero Day Initiative.
References
Author
Publication and revision history
| Date | Change |
|---|---|
| November 3, 2026 | Publication on openai.com. |