ZDI-26-651: (Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability

OpenAI Codex Desktop for Windows and macOS automatically inspects Git metadata and working-tree status whenever a user opens a workspace, and if that workspace contains a repository whose attacker-controlled .git/config has been preserved, Git's attr.tree setting combined with a configured clean or process filter causes Git to execute an attacker-supplied program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without any workspace-trust prompt, command approval, or model interaction, so merely opening the crafted workspace is enough. A successful attacker can read, modify, or delete files and access any credentials available to that user. Exploitation requires Git to be present on PATH and the user to open a repository delivered with its local Git configuration intact, e.g. via an archive or shared folder, since an ordinary Git clone does not copy .git/config and is not sufficient by itself. No public PoC is known, the flaw is not in CISA KEV, and EPSS assigns a 0.3% 30-day exploitation probability, though the bug was demonstrated at Pwn2Own (ZDI-26-651).

Do: Update OpenAI Codex Desktop to the latest vendor build as soon as a patched release is available (no fixed version number was provided in the source data). Until patched, avoid opening untrusted repositories received as archives, downloads, or shared folders that retain their .git/config, or first inspect that file and remove attr.tree and any clean/process filter entries (e.g. filter.<driver>.clean/process) before opening the workspace. Confirm whether Git is on PATH on affected machines, since the spawned process executes outside Codex's sandbox with full user privileges.