ZDI publishes four CVSS 7.8 OpenAI Codex remote code execution vulnerabilities (CVE-2026-19590 through CVE-2026-19593) demonstrated at Pwn2Own

CVE-2026-19590 is a configuration-trust flaw (CWE-427, uncontrolled search path element) in OpenAI Codex Desktop for Windows and macOS, where automated Git operations inside Codex trust the repository's local core.hooksPath setting. It is triggered when a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath at an attacker-controlled directory, causing Codex to execute the attacker's Git hook while processing the repository; an ordinary git clone does not preserve that repository-local configuration, so plain clones are not a delivery path. The hook runs outside Codex's command sandbox, without user approval, and with the user's privileges, giving the attacker the ability to read, modify, or delete the user's files and access other resources available to the user's account. Anyone running an unpatched Codex Desktop on Windows or macOS who opens a repository obtained outside a normal clone (for example an archive or shared folder containing .git/config) is affected. It is scored 7.3 (high, local vector with user interaction), EPSS is 0.1% (1st percentile), it is not in CISA KEV, no public PoC is known, and the issue was publicly documented via ZDI (ZDI-26-648) following a Pwn2Own demonstration.

Do: Update Codex Desktop to the patched release published by OpenAI (fixed version numbers are not stated in the source data; check the vendor advisory). Until patched, avoid opening untrusted repositories delivered with a preserved .git directory (e.g., zip archives or shared/synced folders) and inspect .git/config for a repository-local core.hooksPath before opening; plain git clones are not an attack path.

OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) misclassify certain PowerShell commands as safe because the command-safety parser handles PowerShell's stop-parsing token (--%) differently from PowerShell itself (CWE-150, improper neutralization of control sequences). An attacker triggers this by preparing a repository whose instructions cause Codex to run a file-writing Git command through PowerShell without the usual user-approval prompt; on macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration, and when Codex later loads the modified configuration, it launches an attacker-controlled MCP server, giving the attacker code execution with the user's privileges and the ability to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing, so the default sandbox on macOS and Linux can prevent writes outside permitted locations and limit the attack. No public PoC or in-the-wild exploitation is currently known; the flaw was demonstrated at Pwn2Own (ZDI-26-649) and carries a low 30-day exploitation probability (EPSS 0.3%).

Do: Update Codex CLI and Codex Desktop to the latest patched release (fixed version numbers are not specified in the available data). Until patched, avoid opening untrusted repositories with Codex and review Codex configuration for unexpected or unapproved MCP server entries; macOS and Linux users should note that exploitation requires locally installed PowerShell Core (pwsh) and that the default filesystem sandbox may already block the configuration write.

OpenAI Codex CLI and Codex Desktop automatically collect Git repository metadata without disabling the repository-local core.fsmonitor setting, so Git can execute the filesystem-monitor helper named in a repository's .git/config while Codex gathers that metadata. The flaw is triggered when a user opens or works in a repository prepared by an attacker and delivered with its .git/config intact, such as a copied folder or archive, because an ordinary Git clone does not preserve the source repository's local config. The attacker-supplied helper runs outside Codex's command sandbox and without any user-approval prompt, giving the attacker code execution with the user's privileges, including the ability to read, modify, or delete the user's files and access other resources available to that account. Anyone running Codex CLI on Windows, macOS, or Linux or Codex Desktop on Windows or macOS who opens untrusted repositories is exposed, and related reporting indicates the same malicious .git/config pattern also affects other AI coding agents such as Claude and Cursor, although this CVE is scoped to Codex. No exploitation is currently known: there is no public proof-of-concept, EPSS is a low 0.1%, the issue is not in CISA KEV, and it was disclosed through Pwn2Own as ZDI-26-650.

Do: Update Codex CLI and Codex Desktop to the latest available release containing the fix as soon as it is published (no specific fixed version number is provided in the available data). Until updating, avoid opening untrusted repositories delivered with their .git/config intact, and inspect .git/config for a core.fsmonitor entry pointing at an unknown or attacker-supplied helper before working in such a repository with Codex. Note that a plain git clone from a remote does not preserve the malicious local config, so archives, copied directories, and dotfile restoration are the delivery paths to watch.

OpenAI Codex Desktop for Windows and macOS automatically inspects Git metadata and working-tree status whenever a user opens a workspace, and if that workspace contains a repository whose attacker-controlled .git/config has been preserved, Git's attr.tree setting combined with a configured clean or process filter causes Git to execute an attacker-supplied program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without any workspace-trust prompt, command approval, or model interaction, so merely opening the crafted workspace is enough. A successful attacker can read, modify, or delete files and access any credentials available to that user. Exploitation requires Git to be present on PATH and the user to open a repository delivered with its local Git configuration intact, e.g. via an archive or shared folder, since an ordinary Git clone does not copy .git/config and is not sufficient by itself. No public PoC is known, the flaw is not in CISA KEV, and EPSS assigns a 0.3% 30-day exploitation probability, though the bug was demonstrated at Pwn2Own (ZDI-26-651).

Do: Update OpenAI Codex Desktop to the latest vendor build as soon as a patched release is available (no fixed version number was provided in the source data). Until patched, avoid opening untrusted repositories received as archives, downloads, or shared folders that retain their .git/config, or first inspect that file and remove attr.tree and any clean/process filter entries (e.g. filter.<driver>.clean/process) before opening the workspace. Confirm whether Git is on PATH on affected machines, since the spawned process executes outside Codex's sandbox with full user privileges.