CVE-2026-19592
Received Received - Intake

Code Execution via Git Metadata Collection in OpenAI Codex

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: OAI

Description
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git can execute that helper while Codex collects repository metadata. The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges. The code can read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the source repository's local .git/config; exploitation requires a repository delivered or copied with that configuration intact.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-19592
EUVD
EUVD-2026-69396

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openai codex *-*
openai codex *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-15 One or more system settings or configuration elements can be externally controlled by a user.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenAI Codex CLI and Desktop for Windows, macOS, and Linux automatically collected Git repository metadata without disabling the core.fsmonitor setting. If a user opens an attacker-prepared repository with a modified .git/config that sets core.fsmonitor to an attacker-controlled helper, Git executes that helper while Codex collects metadata. The helper runs outside Codex's sandbox and without user approval, allowing attacker code to execute with the user's privileges.

Detection Guidance

Check Git repositories for modified .git/config files with core.fsmonitor set to suspicious paths. Inspect recent Git operations or metadata collections by Codex for unexpected filesystem access.

Impact Analysis

This vulnerability allows an attacker to run malicious code on your system with your privileges. The code can read, modify, or delete your files and access other resources available to your account. Exploitation requires opening a specially crafted repository that preserves the attacker's .git/config settings.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Attackers could read, modify, or delete files, potentially exposing regulated data without user consent.

Mitigation Strategies

Update Codex to the latest version that ignores fsmonitor config. Avoid using attacker-prepared repositories and review .git/config files for unauthorized core.fsmonitor settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19592. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart