What is the CVSS score of CVE-2026-19590?

CVE-2026-19590 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-19590?

Within 24 hours: Alert all Codex Desktop users and restrict Git operations to trusted internal repositories only, or disable Git integration entirely. Within 7 days: Implement mandatory security review of .git/config files before users open external repositories, and establish repository access policies that prevent or override the core.hooksPath setting. Within 30 days: Monitor GitHub PR #22843 and OpenAI's official security advisories for patch availability; apply the vendor patch to all Codex Desktop installations immediately upon release.

OpenAI Codex Desktop CVE-2026-19590

EUVD-2026-69393 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-09-01 OAI

GHSA-433v-pqvh-w4gj

Apple Microsoft Codex Desktop Codex Desktop Microsoft Store Package Openai

7.3

CVSS 3.1 · Vendor: OAI

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker crafts repo with malicious core.hooksPath in .git/config
Delivery

User receives and opens repo in Codex Desktop
Exploit

Codex triggers automated Git operation (status or index write)
Execution

Git respects core.hooksPath directive
Persist

Malicious hook executes outside Codex sandbox
Impact

Attacker reads, modifies, or deletes files at user privilege level

Vulnerability Assessment

Weakness	CWE CWE-427 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V13 - Configuration Search path element control
Exploitation Conditions	The victim must open an attacker-prepared repository in Codex Desktop where the repository's `.git/config` contains a `core.hooksPath` directive pointing to an attacker-controlled directory with executable hook scripts. A standard `git clone` does NOT satisfy this condition because clone does not preserve repository-local configuration; the attacker must deliver the repository with `.git/config` already in place - for example via a tarball, ZIP archive, shared filesystem path, or a pre-configured fork download. Once the repository is opened, no further user action is needed; Codex automatically triggers Git operations (status checks, index writes) that invoke hooks. Exploitation is limited to Codex Desktop users on Windows and macOS running affected versions; Codex CLI, API, and web integrations are not affected per available data. The hook executes outside Codex's command sandbox and does not trigger Codex's user-approval flow.
Impact	The CVSS 3.1 score of 7.3 reflects the local attack vector (AV:L), user interaction requirement (UI:R), and otherwise low-complexity, full-impact profile (C:H/I:H/A:H) - a calibrated assessment for a flaw that demands the victim actively open a malicious repository. EPSS of 0.13% places this in the 3rd percentile of exploitability probability, and the absence from CISA KEV confirms no known active exploitation at time of analysis. Real-world risk is materially bounded by the delivery prerequisite: a standard `git clone` does not preserve repository-local configuration, so the attacker must engineer delivery of a pre-configured repository archive or shared directory. Nevertheless, even a mid-sized development team in rybnik that routinely accepts shared codebases or evaluates external pull-request branches via Codex Desktop faces a credible supply-chain trust risk, as the hook fires automatically on repository open without any additional user action. The scope is strictly limited to Codex Desktop users; Codex CLI and API integrations are not implicated by available evidence.
Exploit ScenarioDerived	An attacker creates a Git repository with a `.git/config` containing `core.hooksPath = .git/evil-hooks` and plants a malicious `post-index-change` shell script in that directory. The repository is delivered to a developer via a shared ZIP archive, a code-review request, or a pre-configured fork. When the developer opens the repository in Codex Desktop, Codex's automatic status-check or index baseline write invokes Git, which executes the hook outside Codex's sandbox with the developer's OS privileges - enabling credential theft, backdoor installation, or data exfiltration without any additional user prompt.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 03, 2026

Arbitrary code execution in OpenAI Codex Desktop for Windows and macOS allows an attacker's Git hooks to run outside the application's command sandbox when a user opens a specially prepared repository. Codex's automated Git operations honored the repository-local core.hooksPath setting in .git/config without sanitizing or overriding it, enabling a malicious hook script to execute with the user's full OS privileges - reading, modifying, or deleting files and accessing other resources. No active exploitation has been identified (EPSS 0.13%, not in CISA KEV); a code-level fix exists in GitHub PR #22843 but a versioned patch release is not independently confirmed at time of analysis.

RemediationAI

Upgrade to a fixed version of Codex Desktop once OpenAI releases a patched build incorporating the changes from GitHub PR #22843; the upstream fix is confirmed via reviewed diff but a tagged release version has not been independently verified at time of analysis - monitor https://github.com/openai/codex/releases for the published version. The fix overrides core.hooksPath to /dev/null (Unix) or NUL (Windows) on every internal Codex Git invocation, preventing repository-configured hook directories from being honored. As an interim measure, avoid opening repositories received from untrusted or unverified sources in Codex Desktop, and inspect .git/config for unexpected core.hooksPath entries before loading any externally sourced repository. Restricting OS-level execute permissions on directories within repository working trees can reduce but not eliminate risk, as the attacker-controlled hook directory may be placed anywhere writable by the user.

Affected VersionsENISA

Codex Desktop (Microsoft Store package) 26.304.38.0 ≤26.513.4821.0

Codex Desktop 26.304.38 ≤26.513.40821

Codex Desktop 260202.0859 ≤26.513.31313

Affected Packages

euvd codex_desktop no fix

euvd codex_desktop_microsoft_store_package no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

OpenAI Codex Desktop is an AI-powered coding assistant implemented in Rust (codex-rs), running on Windows and macOS, that performs automated Git operations to track repository state - including status checks, index baseline writes, and change detection. The affected mechanism is CWE-427 (Uncontrolled Search Path Element): Codex's internal Git invocations blindly trusted the repository-local core.hooksPath Git configuration directive. Git supports core.hooksPath as a repository-scoped key in .git/config that redirects all hook execution to an arbitrary directory. Because Codex ran Git commands such as git status and index operations without passing -c core.hooksPath=<null>, any repository whose .git/config sets this key to an attacker-controlled path caused Git to execute hook scripts therein - including post-index-change - without any user prompt. CPE identifiers confirm three affected package variants: cpe:2.3:a:openai:codex_desktop:* (standard), cpe:2.3:a:openai:codex_desktop:* (platform-specific), and cpe:2.3:a:openai:codex_desktop_(microsoft_store_package):*. The fix visible in PR #22843 adds -c core.hooksPath=/dev/null (Unix) or -c core.hooksPath=NUL (Windows) to every internal Codex Git invocation, neutralizing repository-configured hook paths system-wide.

Know when Codex Desktop gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (OAI) PRIMARY 7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

AV:L because exploit fires locally when Codex processes the repo; PR:N because the attacker needs no privileges on the victim's system, only to deliver the malicious repository; UI:R because the victim must actively open it.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (OAI).

CVSS VectorVendor: OAI

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 03, 2026 - 15:22 NVD

7.3 (HIGH)

CVE Published

Sep 01, 2026 - 17:04 cve.org

HIGH 7.3

CVE Published

Sep 01, 2026 - 17:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.

Zero Day Initiative Advisories

ZDI-26-648 OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability Sep 2026

Executive ViewAI

Why It Matters

OpenAI Codex Desktop contains a critical code execution vulnerability affecting developers on Windows and macOS that allows arbitrary system commands to run when opening a malicious Git repository, potentially compromising developer machines and access to sensitive intellectual property. The vulnerability exploits improper handling of Git hook configurations, creating a supply-chain risk vector that could enable persistent access to development environments and source code repositories. With no vendor patch currently released, organizations must immediately implement protective controls to prevent exploitation.

Business Impact: High

Compensating Controls

Restrict Codex Git integration to pre-approved internal repositories only; require administrative review and approval before opening external projects; disable automatic Git operations and mandate manual verification of repository configurations; implement OS-level application sandboxing to limit hook execution scope; consider temporary use of alternative IDE Git integrations for external repository work; maintain audit logs of all repository access through Codex.

Threat Intelligence Overview

EPSS Score

0.1%

Top 97% exploitable

Prevalence

Low

specialized AI coding assistant, limited developer-tool deployment footprint

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.