EUVD-2026-41915
GHSA-gj6m-4qqg-3cw8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects the non-trivial requirement to successfully craft indirect prompt injection that survives LLM processing; no system privileges needed; confidentiality impact only.
Primary rating from Vendor (OAI).
CVSS VectorVendor: OAI
Lifecycle Timeline
5DescriptionCVE.org
The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image URL containing sensitive data. The app automatically fetched that URL when rendering the response, sending the embedded data to an attacker-controlled server without a separate user click. Successful exploitation could exfiltrate secrets and other information accessible in the Codex session, including API keys, source code, and data returned by connected tools. No direct integrity or availability impact was demonstrated, and there is no known exploitation in the wild.
AnalysisAI
Remote image auto-fetch in the OpenAI Codex desktop app for macOS (versions prior to 26.527.31326) enables silent exfiltration of session secrets via indirect prompt injection. An attacker who can place malicious instructions into content processed by Codex - such as a tool result, API response, or file read during a session - can manipulate the model into generating a Markdown image tag whose URL encodes sensitive data; the app then automatically fetches that URL, transmitting API keys, source code, or tool-returned data to an attacker-controlled server with no additional user action. No active exploitation is confirmed (not listed in CISA KEV), no public proof-of-concept is identified, and EPSS sits at 0.16% (6th percentile), indicating low current exploitation probability despite the high-value target profile of affected users.
Technical ContextAI
The vulnerability resides in the Markdown rendering pipeline of the OpenAI Codex macOS desktop client (CPE: cpe:2.3:a:openai:codex_desktop_app_for_macos:*:*:*:*:*:*:*:*). The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), arising from the intersection of two behaviors: the app unconditionally fetches remote image URLs embedded in model-generated Markdown at render time, and the underlying LLM is susceptible to indirect prompt injection - where attacker-controlled content in the model's input context (e.g., tool results, ingested file data) manipulates the model's output without the user's knowledge. By embedding injection instructions in any content Codex processes, the attacker causes the LLM to construct a Markdown image tag such as !x, exploiting the app's auto-fetch as an unintended exfiltration side-channel. This pattern is an emerging LLM-specific vulnerability class where the rendering layer becomes a covert data egress path.
RemediationAI
Update the OpenAI Codex desktop app for macOS to version 26.527.31326 or later, which resolves the automatic remote image fetch behavior in model-generated Markdown (per EUVD-2026-41915; vendor product page: https://openai.com/codex/). Prior to patching, the most effective compensating control is to disable or disconnect all connected tools and external integrations within Codex, eliminating the primary indirect injection vector; this trade-off significantly reduces Codex's utility but removes the attacker-controlled input channel. Users who must retain tool integrations should avoid storing high-value secrets - API keys, credentials, tokens - in contexts accessible to the Codex session while processing output from untrusted sources such as third-party repositories, public APIs, or unknown file contents. Network-level egress filtering to block outbound requests to arbitrary external hosts from the Codex process would also prevent URL-based exfiltration, though implementation depends on the macOS firewall or endpoint security tooling in use.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today