CVE-2026-19593: OpenAI Codex Desktop vulnerability
OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Codex Desktop for macOSto a version that resolves this vulnerability.Fixed in 26.519.22136 - Upgrade
Upgrade
Codex Desktop for Windowsto a version that resolves this vulnerability.Fixed in 26.519.21041 - Upgrade
Upgrade
Codex Desktop for Windows (Microsoft Store package)to a version that resolves this vulnerability.Fixed in 26.519.2081.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Codex Desktop on Windows or macOS are exposed if Git is available on PATH and they open an attacker-prepared workspace that includes a repository with its attacker-controlled local .git/config preserved.
Would cloning a malicious repository normally trigger this?
No. A normal Git clone does not copy the source repository's local .git/config, so cloning alone is not sufficient for exploitation.
What must an attacker provide for exploitation to occur?
The attacker must cause the user to open a prepared repository whose local Git configuration remains intact and configures attr.tree together with a clean or process filter that runs an attacker-controlled program.
Does exploitation require approving a command or trusting the workspace?
No. The program can run during Codex's automatic Git metadata and working-tree inspection without a workspace-trust prompt, command approval, model interaction, or execution inside Codex's command sandbox.
What is the impact if exploitation succeeds?
The attacker-controlled program runs with the signed-in user's privileges and can read, modify, or delete files and access credentials available to that user.