CVE-2026-19591

Name of the Vulnerable Software and Affected Versions OpenAI Codex CLI (affected versions not specified) OpenAI Codex Desktop (affected versions not specified)

Description OpenAI Codex CLI and Codex Desktop misclassify certain PowerShell commands as safe due to a discrepancy in how the command-safety parser interprets the stop-parsing token (--%) compared to PowerShell. This allows Codex to execute a file-writing Git command without user approval if a user opens an attacker-prepared repository. On macOS and Linux, this requires PowerShell Core (pwsh) to be installed. If filesystem protections are bypassed, the command can modify the Codex configuration. Subsequently, loading this modified configuration can launch an attacker-controlled MCP server (Model Context Protocol server), enabling arbitrary code execution with user privileges to read, modify, or delete accessible files. This issue has been exploited in the wild.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.