CVE-2026-19592

Name of the Vulnerable Software and Affected Versions OpenAI Codex CLI (affected versions not specified) OpenAI Codex Desktop (affected versions not specified)

Description OpenAI Codex CLI and Codex Desktop automatically collect Git repository metadata without disabling the core.fsmonitor setting. If a user opens an attacker-prepared repository where the .git/config file specifies an attacker-controlled filesystem-monitor helper, Git may execute that helper during the metadata collection process. This execution occurs outside the command sandbox and without a user-approval prompt, allowing arbitrary code to run with the user's privileges. This can lead to the unauthorized reading, modification, or deletion of files and access to other account resources. Exploitation requires the repository to be delivered or copied with the .git/config file intact, as a standard Git clone does not preserve this local configuration. Real-world incidents of this issue being exploited have been reported.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.