Vulnerability-Lookup

GHSA-26WP-42V3-96XP

Vulnerability from github – Published: 2026-09-01 18:30 – Updated: 2026-09-01 18:30

Details

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git can execute that helper while Codex collects repository metadata. The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges. The code can read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the source repository's local .git/config; exploitation requires a repository delivered or copied with that configuration intact.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-19592"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-15"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-01T18:17:40Z",
    "severity": null
  },
  "details": "OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git can execute that helper while Codex collects repository metadata. The helper runs outside Codex\u0027s command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user\u0027s privileges. The code can read, change, or delete the user\u0027s files and access other resources available to the user\u0027s account. An ordinary Git clone does not preserve the source repository\u0027s local .git/config; exploitation requires a repository delivered or copied with that configuration intact.",
  "id": "GHSA-26wp-42v3-96xp",
  "modified": "2026-09-01T18:30:45Z",
  "published": "2026-09-01T18:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19592"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openai/codex/pull/22652"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2026-19592 (GCVE-0-2026-19592)

Vulnerability from cvelistv5 – Published: 2026-09-01 17:14 – Updated: 2026-09-01 19:19

Summary

Severity

No CVSS data available.

CWE

CWE-15 - External Control of System or Configuration Setting

Assigner

OAI mitre root

References

1 reference

URL	Tags
https://github.com/openai/codex/pull/22652

Impacted products

4 products

Vendor	Product	Version
OpenAI	Codex CLI	Affected: 0.102.0 , ≤ 0.130.0 (semver) Unaffected: 0.131.0
OpenAI	Codex Desktop	Affected: 260202.0859 , ≤ 26.513.31313 (custom) Unaffected: 26.519.22136
OpenAI	Codex Desktop	Affected: 26.304.38 , ≤ 26.513.40821 (custom) Unaffected: 26.519.21041
OpenAI	Codex Desktop (Microsoft Store package)	Affected: 26.304.38.0 , ≤ 26.513.4821.0 (custom) Unaffected: 26.519.2081.0

Credits

System Software and Security Lab, Fudan University maitai (@MaitaiThe) of Doyensec (@Doyensec), reporting through the Zero Day Initiative.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows",
            "macOS",
            "Linux"
          ],
          "product": "Codex CLI",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "0.130.0",
              "status": "affected",
              "version": "0.102.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.131.0"
            }
          ]
        },
        {
          "platforms": [
            "macOS"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.31313",
              "status": "affected",
              "version": "260202.0859",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.22136"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.40821",
              "status": "affected",
              "version": "26.304.38",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.21041"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Codex Desktop (Microsoft Store package)",
          "vendor": "OpenAI",
          "versions": [
            {
              "lessThanOrEqual": "26.513.4821.0",
              "status": "affected",
              "version": "26.304.38.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.519.2081.0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Codex CLI on Windows, macOS, or Linux, or Codex Desktop on macOS or Windows. Requires Git and an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled helper. Automatic Git metadata collection runs the helper outside Codex\u0027s command sandbox without approval. Ordinary Git clones do not preserve the required configuration."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "System Software and Security Lab, Fudan University"
        },
        {
          "lang": "en",
          "value": "maitai (@MaitaiThe) of Doyensec (@Doyensec), reporting through the Zero Day Initiative."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git can execute that helper while Codex collects repository metadata. The helper runs outside Codex\u0027s command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user\u0027s privileges. The code can read, change, or delete the user\u0027s files and access other resources available to the user\u0027s account. An ordinary Git clone does not preserve the source repository\u0027s local .git/config; exploitation requires a repository delivered or copied with that configuration intact."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-15",
              "description": "CWE-15: External Control of System or Configuration Setting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T19:19:51.977Z",
        "orgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
        "shortName": "OAI"
      },
      "references": [
        {
          "url": "https://github.com/openai/codex/pull/22652"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade Codex CLI to version 0.131.0 or later; Codex Desktop for macOS to application version 26.519.22136 or later; and Codex Desktop for Windows to application version 26.519.21041 (Microsoft Store package 26.519.2081.0) or later."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Until updated, do not open or use repository archives or copied directories that preserve attacker-controlled .git/config."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7",
    "assignerShortName": "OAI",
    "cveId": "CVE-2026-19592",
    "datePublished": "2026-09-01T17:14:49.978Z",
    "dateReserved": "2026-08-12T03:54:37.942Z",
    "dateUpdated": "2026-09-01T19:19:51.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-26WP-42V3-96XP

CVE-2026-19592 (GCVE-0-2026-19592)

Tags

Sightings

Nomenclature