CVE-2026-19590

Affected products & versions

Version ranges are inclusive.

Impact

The hook ran with the user's permissions. It could read, change, or delete the user's files and use other resources available to the user's account.

Conditions

Git had to be installed. The user had to open or use a copy of a repository whose local .git/config set core.hooksPath to a directory the attacker controlled. A Git clone does not copy the source repository's local .git/config file.

Known exploitation

No known abuse in the wild.

Mitigations

• Update Codex Desktop for macOS to application version 26.519.22136 or a subsequent version.
• Update Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or a subsequent version.
• Until you update, do not open untrusted repository archives or copies that include the source repository's .git/config file.

Vulnerability description

A Git hook is a program that Git runs during certain operations. Affected versions of Codex Desktop used the repository's core.hooksPath setting during automatic Git operations. This setting could direct Git to a hook in the attacker's directory.

Problem type

CWE-427⁠(opens in a new window) — Uncontrolled Search Path Element.

Credits

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam).

References

• CVE-2026-19590 record⁠(opens in a new window)
• Codex fix⁠(opens in a new window)
• Zero Day Initiative advisory ZDI-26-648⁠(opens in a new window)
• All security advisories⁠