CVE-2026-110930
Received
Received - Intake
Code Execution via Malicious Project Path in Codex Desktop
Vulnerability report for CVE-2026-110930, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-05
Last updated on: 2026-11-05
Assigner: OAI
Description
Description
Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| OpenAI | Codex Desktop for Windows | 26.820.60940 |
| OpenAI | Codex Desktop for Windows (Microsoft Store/MSIX package) | 26.820.7780.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-88 | The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
