CVE-2026-19591

Affected products & versions

Version ranges are inclusive.

Impact

If Codex loaded the changed configuration, it could start a server that ran the attacker's code with the user's permissions. That code could read, change, or delete files available to the user. On macOS and Linux, the default filesystem sandbox could prevent Git from changing the configuration file.

Conditions

The user had to open a repository that the attacker prepared, and Codex had to obey its instructions. The attack required Git and PowerShell. On macOS and Linux, Codex had to run a separately installed copy of PowerShell Core (pwsh).

Known exploitation

No known abuse in the wild.

Mitigations

• Update Codex CLI to version 0.131.0 or a subsequent version.
• Update Codex Desktop for macOS to application version 26.519.22136 or a subsequent version.
• Update Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or a subsequent version.
• Until you update, use Codex only with repositories and repository instructions that you trust.
• On macOS and Linux, keep the filesystem sandbox enabled.

Vulnerability description

Codex and PowerShell interpreted the PowerShell stop-parsing token (--%) differently. Codex could treat a Git command that wrote to a file as safe and run it without asking the user.

If Git could write to the Codex configuration file, the command could add a Model Context Protocol (MCP) server that the attacker controlled. The server could run when Codex next loaded the changed configuration.

Problem type

CWE-150⁠(opens in a new window) — Improper Neutralization of Escape, Meta, or Control Sequences.

Credits

Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., and Urs Mueller of Compass Security (@compasssecurity).

References

• CVE-2026-19591 record⁠(opens in a new window)
• Codex fix⁠(opens in a new window)
• Zero Day Initiative advisory ZDI-26-649⁠(opens in a new window)
• All security advisories⁠