AI analysis
OpenAI Codex Desktop for Windows and macOS automatically inspects Git metadata and working-tree status whenever a user opens a workspace, and if that workspace contains a repository whose attacker-controlled .git/config has been preserved, Git's attr.tree setting combined with a configured clean or process filter causes Git to execute an attacker-supplied program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without any workspace-trust prompt, command approval, or model interaction, so merely opening the crafted workspace is enough. A successful attacker can read, modify, or delete files and access any credentials available to that user. Exploitation requires Git to be present on PATH and the user to open a repository delivered with its local Git configuration intact, e.g. via an archive or shared folder, since an ordinary Git clone does not copy .git/config and is not sufficient by itself. No public PoC is known, the flaw is not in CISA KEV, and EPSS assigns a 0.3% 30-day exploitation probability, though the bug was demonstrated at Pwn2Own (ZDI-26-651).
What to do: Update OpenAI Codex Desktop to the latest vendor build as soon as a patched release is available (no fixed version number was provided in the source data). Until patched, avoid opening untrusted repositories received as archives, downloads, or shared folders that retain their .git/config, or first inspect that file and remove attr.tree and any clean/process filter entries (e.g. filter.<driver>.clean/process) before opening the workspace. Confirm whether Git is on PATH on affected machines, since the spawned process executes outside Codex's sandbox with full user privileges.
Estimated exposure
moderate≈10,000–100,000 desktop users (estimate; no published install counts) — Codex Desktop is a recently released, developer-focused client with no public install counts in the source data, so the order of magnitude reflects estimated adoption of OpenAI's Codex desktop tooling, further narrowed by the preconditions…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.