Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    8 vulnerabilities found for Codex Desktop by OpenAI

    CVE-2026-19593 (GCVE-0-2026-19593)

    Vulnerability from nvd – Published: 2026-09-01 17:10 – Updated: 2026-09-01 17:10
    VLAI
    Summary
    OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.
    Severity
    No CVSS data available.
    CWE
    • CWE-15 - External Control of System or Configuration Setting
    Assigner
    References
    Impacted products
    Vendor Product Version
    OpenAI Codex Desktop Affected: 260202.0859 , ≤ 26.513.31313 (custom)
    Unaffected: 26.519.22136
    		Create a notification for this product.
    OpenAI Codex Desktop Affected: 26.304.38 , ≤ 26.513.40821 (custom)
    Unaffected: 26.519.21041
    		Create a notification for this product.
    OpenAI Codex Desktop (Microsoft Store package) Affected: 26.304.38.0 , ≤ 26.513.4821.0 (custom)
    Unaffected: 26.519.2081.0
    		Create a notification for this product.
    Credits
    Satoki Tsuji (@satoki00) / Ikotas Labs, Inc.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "platforms": [
            "macOS"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.31313",
              "status": "affected",
              "version": "260202.0859",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.22136"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.40821",
              "status": "affected",
              "version": "26.304.38",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.21041"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop (Microsoft Store package)",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.4821.0",
              "status": "affected",
              "version": "26.304.38.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.2081.0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "macOS or Windows with Git available on PATH and an attacker-supplied workspace preserving attacker-controlled .git/config, Git attributes, and clean or process filter settings. The app-side Git worker executes the helper outside Codex\u0027s command sandbox without a workspace-trust prompt or command approval. A normal Git clone does not preserve the source repository\u0027s local .git/config."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Satoki Tsuji (@satoki00) / Ikotas Labs, Inc."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex\u0027s command sandbox with the signed-in user\u0027s privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository\u0027s .git/config and is not sufficient by itself."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-15",
              "description": "CWE-15: External Control of System or Configuration Setting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T17:10:24.909Z",
        "orgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
        "shortName": "OAI"
      },
      "references": [
        {
          "url": "https://openai.com/codex"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Codex Desktop for macOS to application version 26.519.22136 or later, or Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or later."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Until updated, do not open attacker-supplied workspace folders that retain untrusted .git metadata."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
    "assignerShortName": "OAI",
    "cveId": "CVE-2026-19593",
    "datePublished": "2026-09-01T17:10:24.909Z",
    "dateReserved": "2026-08-12T03:54:42.487Z",
    "dateUpdated": "2026-09-01T17:10:24.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19592 (GCVE-0-2026-19592)

    Vulnerability from nvd – Published: 2026-09-01 17:14 – Updated: 2026-09-01 19:19
    VLAI
    Summary
    OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git can execute that helper while Codex collects repository metadata. The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges. The code can read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the source repository's local .git/config; exploitation requires a repository delivered or copied with that configuration intact.
    Severity
    No CVSS data available.
    CWE
    • CWE-15 - External Control of System or Configuration Setting
    Assigner
    References
    Impacted products
    Vendor Product Version
    OpenAI Codex CLI Affected: 0.102.0 , ≤ 0.130.0 (semver)
    Unaffected: 0.131.0
    		Create a notification for this product.
    OpenAI Codex Desktop Affected: 260202.0859 , ≤ 26.513.31313 (custom)
    Unaffected: 26.519.22136
    		Create a notification for this product.
    OpenAI Codex Desktop Affected: 26.304.38 , ≤ 26.513.40821 (custom)
    Unaffected: 26.519.21041
    		Create a notification for this product.
    OpenAI Codex Desktop (Microsoft Store package) Affected: 26.304.38.0 , ≤ 26.513.4821.0 (custom)
    Unaffected: 26.519.2081.0
    		Create a notification for this product.
    Credits
    System Software and Security Lab, Fudan University maitai (@MaitaiThe) of Doyensec (@Doyensec), reporting through the Zero Day Initiative.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows",
            "macOS",
            "Linux"
          ],
          "product": "Codex CLI",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "0.130.0",
              "status": "affected",
              "version": "0.102.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.131.0"
            }
          ]
        },
        {
          "platforms": [
            "macOS"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.31313",
              "status": "affected",
              "version": "260202.0859",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.22136"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.40821",
              "status": "affected",
              "version": "26.304.38",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.21041"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop (Microsoft Store package)",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.4821.0",
              "status": "affected",
              "version": "26.304.38.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.2081.0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Codex CLI on Windows, macOS, or Linux, or Codex Desktop on macOS or Windows. Requires Git and an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled helper. Automatic Git metadata collection runs the helper outside Codex\u0027s command sandbox without approval. Ordinary Git clones do not preserve the required configuration."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "System Software and Security Lab, Fudan University"
        },
        {
          "lang": "en",
          "value": "maitai (@MaitaiThe) of Doyensec (@Doyensec), reporting through the Zero Day Initiative."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git can execute that helper while Codex collects repository metadata. The helper runs outside Codex\u0027s command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user\u0027s privileges. The code can read, change, or delete the user\u0027s files and access other resources available to the user\u0027s account. An ordinary Git clone does not preserve the source repository\u0027s local .git/config; exploitation requires a repository delivered or copied with that configuration intact."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-15",
              "description": "CWE-15: External Control of System or Configuration Setting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T19:19:51.977Z",
        "orgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
        "shortName": "OAI"
      },
      "references": [
        {
          "url": "https://github.com/openai/codex/pull/22652"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade Codex CLI to version 0.131.0 or later; Codex Desktop for macOS to application version 26.519.22136 or later; and Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or later."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Until updated, do not open or use repository archives or copied directories that preserve attacker-controlled .git/config."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
    "assignerShortName": "OAI",
    "cveId": "CVE-2026-19592",
    "datePublished": "2026-09-01T17:14:49.978Z",
    "dateReserved": "2026-08-12T03:54:37.942Z",
    "dateUpdated": "2026-09-01T19:19:51.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19591 (GCVE-0-2026-19591)

    Vulnerability from nvd – Published: 2026-09-01 17:06 – Updated: 2026-09-01 17:06
    VLAI
    Summary
    OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user's privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations.
    Severity
    No CVSS data available.
    CWE
    • CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
    Assigner
    References
    Impacted products
    Vendor Product Version
    OpenAI Codex CLI Affected: 0.72.0 , ≤ 0.130.0 (semver)
    Unaffected: 0.131.0
    		Create a notification for this product.
    OpenAI Codex Desktop Affected: 260202.0859 , ≤ 26.513.31313 (custom)
    Unaffected: 26.519.22136
    		Create a notification for this product.
    OpenAI Codex Desktop Affected: 26.304.38 , ≤ 26.513.40821 (custom)
    Unaffected: 26.519.21041
    		Create a notification for this product.
    OpenAI Codex Desktop (Microsoft Store package) Affected: 26.304.38.0 , ≤ 26.513.4821.0 (custom)
    Unaffected: 26.519.2081.0
    		Create a notification for this product.
    Credits
    Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., and Urs Mueller of Compass Security (@compasssecurity).
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows",
            "macOS",
            "Linux"
          ],
          "product": "Codex CLI",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "0.130.0",
              "status": "affected",
              "version": "0.72.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.131.0"
            }
          ]
        },
        {
          "platforms": [
            "macOS"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.31313",
              "status": "affected",
              "version": "260202.0859",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.22136"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.40821",
              "status": "affected",
              "version": "26.304.38",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.21041"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop (Microsoft Store package)",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.4821.0",
              "status": "affected",
              "version": "26.304.38.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.2081.0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Codex CLI for Windows, macOS, or Linux, or Codex Desktop for Windows or macOS, with Git and PowerShell. Windows normally includes PowerShell; macOS and Linux require separately installed PowerShell Core (pwsh) to be invoked. Exploitation requires an attacker-prepared repository whose instructions Codex follows. Misclassification bypasses command approval but does not itself disable filesystem sandboxing; code execution also requires a successful configuration write and later configuration load."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., and Urs Mueller of Compass Security (@compasssecurity)."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell\u0027s stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex\u0027s configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user\u0027s privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T17:06:45.647Z",
        "orgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
        "shortName": "OAI"
      },
      "references": [
        {
          "url": "https://github.com/openai/codex/pull/22643"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade Codex CLI to version 0.131.0 or later, Codex Desktop for macOS to application version 26.519.22136 or later, or Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or later."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Until updated, do not open or follow instructions from untrusted repositories. On macOS and Linux, keep filesystem sandboxing enabled."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
    "assignerShortName": "OAI",
    "cveId": "CVE-2026-19591",
    "datePublished": "2026-09-01T17:06:45.647Z",
    "dateReserved": "2026-08-12T03:54:33.704Z",
    "dateUpdated": "2026-09-01T17:06:45.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19590 (GCVE-0-2026-19590)

    Vulnerability from nvd – Published: 2026-09-01 17:04 – Updated: 2026-09-01 17:04
    VLAI
    Summary
    OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.
    Severity
    No CVSS data available.
    CWE
    • CWE-427 - Uncontrolled Search Path Element
    Assigner
    References
    Impacted products
    Vendor Product Version
    OpenAI Codex Desktop Affected: 260202.0859 , ≤ 26.513.31313 (custom)
    Unaffected: 26.519.22136
    		Create a notification for this product.
    OpenAI Codex Desktop Affected: 26.304.38 , ≤ 26.513.40821 (custom)
    Unaffected: 26.519.21041
    		Create a notification for this product.
    OpenAI Codex Desktop (Microsoft Store package) Affected: 26.304.38.0 , ≤ 26.513.4821.0 (custom)
    Unaffected: 26.519.2081.0
    		Create a notification for this product.
    Credits
    Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam).
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "platforms": [
            "macOS"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.31313",
              "status": "affected",
              "version": "260202.0859",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.22136"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.40821",
              "status": "affected",
              "version": "26.304.38",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.21041"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop (Microsoft Store package)",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.4821.0",
              "status": "affected",
              "version": "26.304.38.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.2081.0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Codex Desktop for macOS or Windows with Git and an attacker-prepared repository whose preserved .git/config sets core.hooksPath to an attacker-controlled directory. Ordinary Git clones do not preserve this setting."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository\u0027s local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex\u0027s command sandbox, without user approval, and with the user\u0027s privileges, allowing it to read, change, or delete the user\u0027s files and access other resources available to the user\u0027s account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427: Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T17:04:43.060Z",
        "orgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
        "shortName": "OAI"
      },
      "references": [
        {
          "url": "https://github.com/openai/codex/pull/22843"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade Codex Desktop for macOS to application version 26.519.22136 or later, or Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or later."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Until updated, do not open untrusted repository archives or copied repository directories that preserve attacker-supplied .git/config."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
    "assignerShortName": "OAI",
    "cveId": "CVE-2026-19590",
    "datePublished": "2026-09-01T17:04:43.060Z",
    "dateReserved": "2026-08-12T03:54:29.956Z",
    "dateUpdated": "2026-09-01T17:04:43.060Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19592 (GCVE-0-2026-19592)

    Vulnerability from cvelistv5 – Published: 2026-09-01 17:14 – Updated: 2026-09-01 19:19
    VLAI
    Summary
    OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git can execute that helper while Codex collects repository metadata. The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges. The code can read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the source repository's local .git/config; exploitation requires a repository delivered or copied with that configuration intact.
    Severity
    No CVSS data available.
    CWE
    • CWE-15 - External Control of System or Configuration Setting
    Assigner
    References
    Impacted products
    Vendor Product Version
    OpenAI Codex CLI Affected: 0.102.0 , ≤ 0.130.0 (semver)
    Unaffected: 0.131.0
    		Create a notification for this product.
    OpenAI Codex Desktop Affected: 260202.0859 , ≤ 26.513.31313 (custom)
    Unaffected: 26.519.22136
    		Create a notification for this product.
    OpenAI Codex Desktop Affected: 26.304.38 , ≤ 26.513.40821 (custom)
    Unaffected: 26.519.21041
    		Create a notification for this product.
    OpenAI Codex Desktop (Microsoft Store package) Affected: 26.304.38.0 , ≤ 26.513.4821.0 (custom)
    Unaffected: 26.519.2081.0
    		Create a notification for this product.
    Credits
    System Software and Security Lab, Fudan University maitai (@MaitaiThe) of Doyensec (@Doyensec), reporting through the Zero Day Initiative.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows",
            "macOS",
            "Linux"
          ],
          "product": "Codex CLI",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "0.130.0",
              "status": "affected",
              "version": "0.102.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.131.0"
            }
          ]
        },
        {
          "platforms": [
            "macOS"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.31313",
              "status": "affected",
              "version": "260202.0859",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.22136"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.40821",
              "status": "affected",
              "version": "26.304.38",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.21041"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop (Microsoft Store package)",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.4821.0",
              "status": "affected",
              "version": "26.304.38.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.2081.0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Codex CLI on Windows, macOS, or Linux, or Codex Desktop on macOS or Windows. Requires Git and an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled helper. Automatic Git metadata collection runs the helper outside Codex\u0027s command sandbox without approval. Ordinary Git clones do not preserve the required configuration."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "System Software and Security Lab, Fudan University"
        },
        {
          "lang": "en",
          "value": "maitai (@MaitaiThe) of Doyensec (@Doyensec), reporting through the Zero Day Initiative."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git can execute that helper while Codex collects repository metadata. The helper runs outside Codex\u0027s command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user\u0027s privileges. The code can read, change, or delete the user\u0027s files and access other resources available to the user\u0027s account. An ordinary Git clone does not preserve the source repository\u0027s local .git/config; exploitation requires a repository delivered or copied with that configuration intact."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-15",
              "description": "CWE-15: External Control of System or Configuration Setting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T19:19:51.977Z",
        "orgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
        "shortName": "OAI"
      },
      "references": [
        {
          "url": "https://github.com/openai/codex/pull/22652"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade Codex CLI to version 0.131.0 or later; Codex Desktop for macOS to application version 26.519.22136 or later; and Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or later."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Until updated, do not open or use repository archives or copied directories that preserve attacker-controlled .git/config."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
    "assignerShortName": "OAI",
    "cveId": "CVE-2026-19592",
    "datePublished": "2026-09-01T17:14:49.978Z",
    "dateReserved": "2026-08-12T03:54:37.942Z",
    "dateUpdated": "2026-09-01T19:19:51.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19593 (GCVE-0-2026-19593)

    Vulnerability from cvelistv5 – Published: 2026-09-01 17:10 – Updated: 2026-09-01 17:10
    VLAI
    Summary
    OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.
    Severity
    No CVSS data available.
    CWE
    • CWE-15 - External Control of System or Configuration Setting
    Assigner
    References
    Impacted products
    Vendor Product Version
    OpenAI Codex Desktop Affected: 260202.0859 , ≤ 26.513.31313 (custom)
    Unaffected: 26.519.22136
    		Create a notification for this product.
    OpenAI Codex Desktop Affected: 26.304.38 , ≤ 26.513.40821 (custom)
    Unaffected: 26.519.21041
    		Create a notification for this product.
    OpenAI Codex Desktop (Microsoft Store package) Affected: 26.304.38.0 , ≤ 26.513.4821.0 (custom)
    Unaffected: 26.519.2081.0
    		Create a notification for this product.
    Credits
    Satoki Tsuji (@satoki00) / Ikotas Labs, Inc.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "platforms": [
            "macOS"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.31313",
              "status": "affected",
              "version": "260202.0859",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.22136"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.40821",
              "status": "affected",
              "version": "26.304.38",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.21041"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop (Microsoft Store package)",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.4821.0",
              "status": "affected",
              "version": "26.304.38.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.2081.0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "macOS or Windows with Git available on PATH and an attacker-supplied workspace preserving attacker-controlled .git/config, Git attributes, and clean or process filter settings. The app-side Git worker executes the helper outside Codex\u0027s command sandbox without a workspace-trust prompt or command approval. A normal Git clone does not preserve the source repository\u0027s local .git/config."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Satoki Tsuji (@satoki00) / Ikotas Labs, Inc."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex\u0027s command sandbox with the signed-in user\u0027s privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository\u0027s .git/config and is not sufficient by itself."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-15",
              "description": "CWE-15: External Control of System or Configuration Setting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T17:10:24.909Z",
        "orgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
        "shortName": "OAI"
      },
      "references": [
        {
          "url": "https://openai.com/codex"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Codex Desktop for macOS to application version 26.519.22136 or later, or Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or later."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Until updated, do not open attacker-supplied workspace folders that retain untrusted .git metadata."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
    "assignerShortName": "OAI",
    "cveId": "CVE-2026-19593",
    "datePublished": "2026-09-01T17:10:24.909Z",
    "dateReserved": "2026-08-12T03:54:42.487Z",
    "dateUpdated": "2026-09-01T17:10:24.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19591 (GCVE-0-2026-19591)

    Vulnerability from cvelistv5 – Published: 2026-09-01 17:06 – Updated: 2026-09-01 17:06
    VLAI
    Summary
    OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user's privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations.
    Severity
    No CVSS data available.
    CWE
    • CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
    Assigner
    References
    Impacted products
    Vendor Product Version
    OpenAI Codex CLI Affected: 0.72.0 , ≤ 0.130.0 (semver)
    Unaffected: 0.131.0
    		Create a notification for this product.
    OpenAI Codex Desktop Affected: 260202.0859 , ≤ 26.513.31313 (custom)
    Unaffected: 26.519.22136
    		Create a notification for this product.
    OpenAI Codex Desktop Affected: 26.304.38 , ≤ 26.513.40821 (custom)
    Unaffected: 26.519.21041
    		Create a notification for this product.
    OpenAI Codex Desktop (Microsoft Store package) Affected: 26.304.38.0 , ≤ 26.513.4821.0 (custom)
    Unaffected: 26.519.2081.0
    		Create a notification for this product.
    Credits
    Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., and Urs Mueller of Compass Security (@compasssecurity).
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows",
            "macOS",
            "Linux"
          ],
          "product": "Codex CLI",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "0.130.0",
              "status": "affected",
              "version": "0.72.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.131.0"
            }
          ]
        },
        {
          "platforms": [
            "macOS"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.31313",
              "status": "affected",
              "version": "260202.0859",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.22136"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.40821",
              "status": "affected",
              "version": "26.304.38",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.21041"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop (Microsoft Store package)",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.4821.0",
              "status": "affected",
              "version": "26.304.38.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.2081.0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Codex CLI for Windows, macOS, or Linux, or Codex Desktop for Windows or macOS, with Git and PowerShell. Windows normally includes PowerShell; macOS and Linux require separately installed PowerShell Core (pwsh) to be invoked. Exploitation requires an attacker-prepared repository whose instructions Codex follows. Misclassification bypasses command approval but does not itself disable filesystem sandboxing; code execution also requires a successful configuration write and later configuration load."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., and Urs Mueller of Compass Security (@compasssecurity)."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell\u0027s stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex\u0027s configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user\u0027s privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T17:06:45.647Z",
        "orgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
        "shortName": "OAI"
      },
      "references": [
        {
          "url": "https://github.com/openai/codex/pull/22643"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade Codex CLI to version 0.131.0 or later, Codex Desktop for macOS to application version 26.519.22136 or later, or Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or later."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Until updated, do not open or follow instructions from untrusted repositories. On macOS and Linux, keep filesystem sandboxing enabled."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
    "assignerShortName": "OAI",
    "cveId": "CVE-2026-19591",
    "datePublished": "2026-09-01T17:06:45.647Z",
    "dateReserved": "2026-08-12T03:54:33.704Z",
    "dateUpdated": "2026-09-01T17:06:45.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19590 (GCVE-0-2026-19590)

    Vulnerability from cvelistv5 – Published: 2026-09-01 17:04 – Updated: 2026-09-01 17:04
    VLAI
    Summary
    OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.
    Severity
    No CVSS data available.
    CWE
    • CWE-427 - Uncontrolled Search Path Element
    Assigner
    References
    Impacted products
    Vendor Product Version
    OpenAI Codex Desktop Affected: 260202.0859 , ≤ 26.513.31313 (custom)
    Unaffected: 26.519.22136
    		Create a notification for this product.
    OpenAI Codex Desktop Affected: 26.304.38 , ≤ 26.513.40821 (custom)
    Unaffected: 26.519.21041
    		Create a notification for this product.
    OpenAI Codex Desktop (Microsoft Store package) Affected: 26.304.38.0 , ≤ 26.513.4821.0 (custom)
    Unaffected: 26.519.2081.0
    		Create a notification for this product.
    Credits
    Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam).
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "platforms": [
            "macOS"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.31313",
              "status": "affected",
              "version": "260202.0859",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.22136"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.40821",
              "status": "affected",
              "version": "26.304.38",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.21041"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop (Microsoft Store package)",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.4821.0",
              "status": "affected",
              "version": "26.304.38.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.2081.0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Codex Desktop for macOS or Windows with Git and an attacker-prepared repository whose preserved .git/config sets core.hooksPath to an attacker-controlled directory. Ordinary Git clones do not preserve this setting."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository\u0027s local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex\u0027s command sandbox, without user approval, and with the user\u0027s privileges, allowing it to read, change, or delete the user\u0027s files and access other resources available to the user\u0027s account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427: Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T17:04:43.060Z",
        "orgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
        "shortName": "OAI"
      },
      "references": [
        {
          "url": "https://github.com/openai/codex/pull/22843"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade Codex Desktop for macOS to application version 26.519.22136 or later, or Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or later."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Until updated, do not open untrusted repository archives or copied repository directories that preserve attacker-supplied .git/config."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
    "assignerShortName": "OAI",
    "cveId": "CVE-2026-19590",
    "datePublished": "2026-09-01T17:04:43.060Z",
    "dateReserved": "2026-08-12T03:54:29.956Z",
    "dateUpdated": "2026-09-01T17:04:43.060Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}