Unsandboxed attacker code execution in OpenAI Codex via malicious Git core.fsmonitor
AI analysis
OpenAI Codex CLI and Codex Desktop automatically collect Git repository metadata without disabling the repository-local core.fsmonitor setting, so Git can execute the filesystem-monitor helper named in a repository's .git/config while Codex gathers that metadata. The flaw is triggered when a user opens or works in a repository prepared by an attacker and delivered with its .git/config intact, such as a copied folder or archive, because an ordinary Git clone does not preserve the source repository's local config. The attacker-supplied helper runs outside Codex's command sandbox and without any user-approval prompt, giving the attacker code execution with the user's privileges, including the ability to read, modify, or delete the user's files and access other resources available to that account. Anyone running Codex CLI on Windows, macOS, or Linux or Codex Desktop on Windows or macOS who opens untrusted repositories is exposed, and related reporting indicates the same malicious .git/config pattern also affects other AI coding agents such as Claude and Cursor, although this CVE is scoped to Codex. No exploitation is currently known: there is no public proof-of-concept, EPSS is a low 0.1%, the issue is not in CISA KEV, and it was disclosed through Pwn2Own as ZDI-26-650.
What to do: Update Codex CLI and Codex Desktop to the latest available release containing the fix as soon as it is published (no specific fixed version number is provided in the available data). Until updating, avoid opening untrusted repositories delivered with their .git/config intact, and inspect .git/config for a core.fsmonitor entry pointing at an unknown or attacker-supplied helper before working in such a repository with Codex. Note that a plain git clone from a remote does not preserve the malicious local config, so archives, copied directories, and dotfile restoration are the delivery paths to watch.
Affected
| OpenAI Codex CLI (Windows, macOS, and Linux) | — |
| OpenAI Codex Desktop (Windows and macOS) | — |
Estimated exposure
largeon the order of hundreds of thousands of developers running Codex CLI or Codex Desktop (estimate; no official install counts available) — Estimated from Codex's standing as one of the most widely adopted AI coding agents among the tens of millions of active developers; neither the CVE data nor available reporting provides official CLI/Desktop install counts, so this is a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git can execute that helper while Codex collects repository metadata. The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges. The code can read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the source repository's local .git/config; exploitation requires a repository delivered or copied with that configuration intact.