CVE-2026-19593
Received Received - Intake

Code Execution in OpenAI Codex Desktop via Git Config

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: OAI

Description
OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-19593
EUVD
EUVD-2026-69395

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openai codex *-*
openai codex *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-15 One or more system settings or configuration elements can be externally controlled by a user.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenAI Codex Desktop for Windows and macOS automatically checked Git metadata and repository status when a user opened a workspace. If the workspace contained a repository with a malicious .git/config file, Git's settings could trigger an attacker-controlled program to run outside Codex's sandbox. This program executes with the user's privileges without requiring approval or interaction, allowing the attacker to access, modify, or delete files and credentials.

Impact Analysis

This vulnerability allows an attacker to execute malicious code on your system with your user privileges. They could steal sensitive files, modify or delete important data, and access credentials you have access to. Exploitation requires you to open a specifically crafted repository with its Git configuration intact.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using Codex may face compliance breaches if attackers exfiltrate regulated data.

Mitigation Strategies

Update OpenAI Codex to the latest version where this issue is fixed. Avoid opening untrusted Git repositories in Codex. Disable Git filters or clean/smudge processes in your global Git config if not needed. Regularly audit .git/config files for suspicious entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19593. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart