ZDI-26-650: (Pwn2Own) OpenAI Codex External Control of Configuration Setting Remote Code Execution Vulnerability
ZDI published advisory ZDI-26-650 for a CVSS 7.8 remote code execution flaw (CVE-2026-19592) in OpenAI Codex, demonstrated at Pwn2Own.
The Zero Day Initiative published advisory ZDI-26-650 describing a remote code execution vulnerability in OpenAI Codex, tracked as CVE-2026-19592 with a CVSS 7.8 score. The flaw involves external control of a configuration setting. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. The bug was demonstrated at Pwn2Own and disclosed through ZDI.
- Remote attacker can execute arbitrary code in OpenAI Codex via external control of configuration settings.
- CVSS 7.8; exploitation requires visiting a malicious page or opening a malicious file.
- Disclosed via ZDI as a Pwn2Own result; no in-the-wild exploitation reported.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-19592 | Unsandboxed attacker code execution in OpenAI Codex via malicious Git core.fsmonitor OpenAI Codex CLI and Codex Desktop automatically collect Git repository metadata without disabling the repository-local core.fsmonitor setting, so Git can execute the filesystem-monitor helper named in a repository's .git/config while Codex gathers that metadata. The flaw is triggered when a user opens or works in a repository prepared by an attacker and delivered with its .git/config intact, such as a copied folder or archive, because an ordinary Git clone does not preserve the source repository's local config. The attacker-supplied helper runs outside Codex's command sandbox and without any user-approval prompt, giving the attacker code execution with the user's privileges, including the ability to read, modify, or delete the user's files and access other resources available to that account. Anyone running Codex CLI on Windows, macOS, or Linux or Codex Desktop on Windows or macOS who opens untrusted repositories is exposed, and related reporting indicates the same malicious .git/config pattern also affects other AI coding agents such as Claude and Cursor, although this CVE is scoped to Codex. No exploitation is currently known: there is no public proof-of-concept, EPSS is a low 0.1%, the issue is not in CISA KEV, and it was disclosed through Pwn2Own as ZDI-26-650. Do: Update Codex CLI and Codex Desktop to the latest available release containing the fix as soon as it is published (no specific fixed version number is provided in the available data). Until updating, avoid opening untrusted repositories delivered with their .git/config intact, and inspect .git/config for a core.fsmonitor entry pointing at an unknown or attacker-supplied helper before working in such a repository with Codex. Note that a plain git clone from a remote does not preserve the malicious local config, so archives, copied directories, and dotfile restoration are the delivery paths to watch. | 7.3 | <1% |
| largeon the order of hundreds of thousands of developers running Codex CLI or Codex Desktop (estimate; no official install counts available) |
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenAI Codex. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-19592.
This source does not provide full text. Read it at zerodayinitiative.com.