CVE-2026-19593

Affected products & versions

Version ranges are inclusive.

Impact

The Codex command sandbox did not restrict the program. It ran with the signed-in user's permissions. The program could read, change, or delete files and get access to credentials available to the user.

Conditions

Git had to be available on PATH. The user had to open a workspace that contained the attacker's local .git/config file and Git attributes. A Git clone does not copy the source repository's local .git/config file.

Known exploitation

No known abuse in the wild.

Mitigations

• Update Codex Desktop for macOS to application version 26.519.22136 or a subsequent version.
• Update Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or a subsequent version.
• Until you update, do not open workspace folders from untrusted sources if the folders contain .git metadata.

Vulnerability description

When a user opened a workspace, Codex Desktop used Git to read repository metadata and check for file changes. An attacker could use the attr.tree setting and a clean or process filter to make Git run a program during this check. The attack did not require the user to interact with a model.

Problem type

CWE-15⁠(opens in a new window) — External Control of System or Configuration Setting.

Credits

Satoki Tsuji (@satoki00) / Ikotas Labs, Inc.

References

• CVE-2026-19593 record⁠(opens in a new window)
• OpenAI Codex⁠
• Zero Day Initiative advisory ZDI-26-651⁠(opens in a new window)
• All security advisories⁠