EUVD-2026-69393
GHSA-433v-pqvh-w4gj
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
AV:L because exploit fires locally when Codex processes the repo; PR:N because the attacker needs no privileges on the victim's system, only to deliver the malicious repository; UI:R because the victim must actively open it.
Primary rating from Vendor (OAI).
CVSS VectorVendor: OAI
Lifecycle Timeline
6DescriptionCVE.org
OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.
AnalysisAI
Arbitrary code execution in OpenAI Codex Desktop for Windows and macOS allows an attacker's Git hooks to run outside the application's command sandbox when a user opens a specially prepared repository. Codex's automated Git operations honored the repository-local core.hooksPath setting in .git/config without sanitizing or overriding it, enabling a malicious hook script to execute with the user's full OS privileges - reading, modifying, or deleting files and accessing other resources. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must open an attacker-prepared repository in Codex Desktop where the repository's `.git/config` contains a `core.hooksPath` directive pointing to an attacker-controlled directory with executable hook scripts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.3 reflects the local attack vector (AV:L), user interaction requirement (UI:R), and otherwise low-complexity, full-impact profile (C:H/I:H/A:H) - a calibrated assessment for a flaw that demands the victim actively open a malicious repository. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a fixed version of Codex Desktop once OpenAI releases a patched build incorporating the changes from GitHub PR #22843; the upstream fix is confirmed via reviewed diff but a tagged release version has not been independently verified at time of analysis - monitor https://github.com/openai/codex/releases for the published version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Alert all Codex Desktop users and restrict Git operations to trusted internal repositories only, or disable Git integration entirely. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Codex Desktop
View allArbitrary code execution in OpenAI Codex Desktop (Windows and macOS, including the Microsoft Store package) occurs when
OpenAI Codex CLI and Codex Desktop's PowerShell command-safety parser failed to recognize PowerShell's stop-parsing toke
Arbitrary code execution in OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) allows an attack
Same weakness CWE-427 – Uncontrolled Search Path Element
View allShare
External POC / Exploit Code
Leaving vuln.today