AI analysis
CVE-2026-19590 is a configuration-trust flaw (CWE-427, uncontrolled search path element) in OpenAI Codex Desktop for Windows and macOS, where automated Git operations inside Codex trust the repository's local core.hooksPath setting. It is triggered when a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath at an attacker-controlled directory, causing Codex to execute the attacker's Git hook while processing the repository; an ordinary git clone does not preserve that repository-local configuration, so plain clones are not a delivery path. The hook runs outside Codex's command sandbox, without user approval, and with the user's privileges, giving the attacker the ability to read, modify, or delete the user's files and access other resources available to the user's account. Anyone running an unpatched Codex Desktop on Windows or macOS who opens a repository obtained outside a normal clone (for example an archive or shared folder containing .git/config) is affected. It is scored 7.3 (high, local vector with user interaction), EPSS is 0.1% (1st percentile), it is not in CISA KEV, no public PoC is known, and the issue was publicly documented via ZDI (ZDI-26-648) following a Pwn2Own demonstration.
What to do: Update Codex Desktop to the patched release published by OpenAI (fixed version numbers are not stated in the source data; check the vendor advisory). Until patched, avoid opening untrusted repositories delivered with a preserved .git directory (e.g., zip archives or shared/synced folders) and inspect .git/config for a repository-local core.hooksPath before opening; plain git clones are not an attack path.
Affected
| OpenAI Codex Desktop for Windows | — |
| OpenAI Codex Desktop for macOS | — |
Estimated exposure
moderate≈ tens of thousands of developer workstations (estimate; no public install-base data for the desktop app) — No public install counts exist for the Codex Desktop app in the provided data, so the order of magnitude is inferred from typical early adoption of a newly released desktop AI coding tool, with practical exposure further narrowed because a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.