CVE-2026-19593: (Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability
OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenAI Codex. User interaction is required to exploit this vulnerability in that the target must open a malicious folder. The specific flaw exists within the handling of configuration files. The issue results from the lack of proper sanitization of configuration settings. An attacker can leverage this vulnerability to execute code in the context of the current user.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenAI Codex Desktop for macOSto a version that resolves this vulnerability.Fixed in 26.519.22136 - Upgrade
Upgrade
OpenAI Codex Desktop for Windowsto a version that resolves this vulnerability.Fixed in 26.519.21041
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Codex Desktop on Windows or macOS are exposed if Git is available on PATH and they open an attacker-prepared workspace that includes a repository with its attacker-controlled local .git/config preserved.
Would cloning a malicious repository normally trigger this?
No. A normal Git clone does not copy the source repository's local .git/config, so cloning alone is not sufficient for exploitation.
What must an attacker provide for exploitation to occur?
The attacker must cause the user to open a prepared repository whose local Git configuration remains intact and configures attr.tree together with a clean or process filter that runs an attacker-controlled program.
Does exploitation require approving a command or trusting the workspace?
No. The program can run during Codex's automatic Git metadata and working-tree inspection without a workspace-trust prompt, command approval, model interaction, or execution inside Codex's command sandbox.
What is the impact if exploitation succeeds?
The attacker-controlled program runs with the signed-in user's privileges and can read, modify, or delete files and access credentials available to that user.