CVE-2026-110930: High severity vulnerability
Published Nov 5, 2026
·Updated
Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Codex Desktop for Windowsto a version that resolves this vulnerability.Fixed in 26.1007.21434 - Upgrade
Upgrade
Codex Desktop for Windows (Microsoft Store/MSIX)to a version that resolves this vulnerability.Fixed in 26.1007.2314.0
Event History
Nov 5, 2026
CVE Published
via MITRE·07:55 PM
Data Sourced
via MITRE·07:55 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness