CVE-2026-19592

OpenAI Codex CLI and Codex Desktop automatically collect Git repository metadata without disabling the repository-local core.fsmonitor setting, so Git can execute the filesystem-monitor helper named in a repository's .git/config while Codex gathers that metadata. The flaw is triggered when a user opens or works in a repository prepared by an attacker and delivered with its .git/config intact, such as a copied folder or archive, because an ordinary Git clone does not preserve the source repository's local config. The attacker-supplied helper runs outside Codex's command sandbox and without any user-approval prompt, giving the attacker code execution with the user's privileges, including the ability to read, modify, or delete the user's files and access other resources available to that account. Anyone running Codex CLI on Windows, macOS, or Linux or Codex Desktop on Windows or macOS who opens untrusted repositories is exposed, and related reporting indicates the same malicious .git/config pattern also affects other AI coding agents such as Claude and Cursor, although this CVE is scoped to Codex. No exploitation is currently known: there is no public proof-of-concept, EPSS is a low 0.1%, the issue is not in CISA KEV, and it was disclosed through Pwn2Own as ZDI-26-650.

What to do: Update Codex CLI and Codex Desktop to the latest available release containing the fix as soon as it is published (no specific fixed version number is provided in the available data). Until updating, avoid opening untrusted repositories delivered with their .git/config intact, and inspect .git/config for a core.fsmonitor entry pointing at an unknown or attacker-supplied helper before working in such a repository with Codex. Note that a plain git clone from a remote does not preserve the malicious local config, so archives, copied directories, and dotfile restoration are the delivery paths to watch.