CVE-2026-19592: Git Git vulnerability
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git can execute that helper while Codex collects repository metadata. The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges. The code can read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the source repository's local .git/config; exploitation requires a repository delivered or copied with that configuration intact.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.131.0 - Upgrade
Upgrade
Codex Desktop for macOSto a version that resolves this vulnerability.Fixed in 26.519.22136 - Upgrade
Upgrade
Codex Desktop for Windowsto a version that resolves this vulnerability.Fixed in 26.519.21041Patch Microsoft Store package 26.519.2081.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Codex CLI on Windows, macOS, or Linux and Codex Desktop on Windows or macOS are exposed when they open or use an attacker-prepared Git repository that retains a malicious repository-local Git configuration.
Does cloning a repository normally trigger this condition?
No. An ordinary Git clone does not preserve the source repository's local .git/config, so exploitation requires a repository to be delivered or copied with that configuration intact.
What does an attacker need to make exploitation possible?
The attacker needs to cause the user to open or use a repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper. Git can then execute that helper when Codex collects repository metadata.
How can I check whether a repository is suspicious?
Inspect the repository-local .git/config for a core.fsmonitor setting. A value pointing to an attacker-controlled filesystem-monitor helper is the condition described for exploitation.
What happens if the helper executes?
It runs outside Codex's command sandbox and without a user-approval prompt, with the user's privileges. It can read, modify, or delete the user's files and access other resources available to that account.