CVE-2026-19593

4th percentile - higher than 4% of all known CVEs

OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.

An attacker can execute arbitrary code with the user's privileges, potentially leading to data theft, file modification, or credential compromise.

Update Codex Desktop to a patched version and avoid opening repositories from untrusted sources, especially those with preserved local Git configuration.