October 30, 2026

CVE-2026-19592

In affected versions of Codex CLI and Codex Desktop, opening or using a repository with an attacker's local Git settings could run a program. Git ran the program as a filesystem monitor. The Codex command sandbox did not restrict it, and Codex did not ask for approval.

Affected products & versions

Vendor	Product	Platform	Affected versions
OpenAI	Codex CLI	Windows, macOS, and Linux	0.102.0–0.130.0
OpenAI	Codex Desktop (application)	macOS	260202.0859–26.513.31313
OpenAI	Codex Desktop (application)	Windows	26.304.38–26.513.40821
OpenAI	Codex Desktop (Microsoft Store package)	Windows	26.304.38.0–26.513.4821.0

Version ranges are inclusive.

Impact

The filesystem monitor ran with the user's permissions. It could read, change, or delete the user's files and use other resources available to the user's account.

Conditions

Git had to be installed. The repository's local .git/config file had to set core.fsmonitor to a program that the attacker controlled. A Git clone does not copy the source repository's local .git/config file.

Known exploitation

No known abuse in the wild.

Mitigations

Update Codex CLI to version 0.131.0 or a subsequent version.
Update Codex Desktop for macOS to application version 26.519.22136 or a subsequent version.
Update Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or a subsequent version.
Until you update, do not open or use untrusted repository archives or copies that include the source repository's .git/config file.

Vulnerability description

Codex automatically used Git to collect repository metadata. During that check, Git could run the program specified by core.fsmonitor. This allowed an attacker who supplied the local configuration to select the program that Git ran.

Problem type

CWE-15⁠(opens in a new window) — External Control of System or Configuration Setting.

Credits

System Software and Security Lab, Fudan University
maitai (@MaitaiThe) of Doyensec (@Doyensec), reporting through the Zero Day Initiative.

References

Cybersecurity

Author

OpenAI

Publication and revision history

Date	Change
September 1, 2026	Original publication of the CVE record⁠(opens in a new window).
October 30, 2026	Publication on openai.com.