EUVD-2026-69394
GHSA-2frj-4qr5-m2rf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AC:H reflects multi-step chain requirements: filesystem sandbox must permit config write, Codex must reload config, and pwsh must be present on non-Windows platforms.
Primary rating from Vendor (OAI).
CVSS VectorVendor: OAI
Lifecycle Timeline
6DescriptionCVE.org
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user's privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations.
AnalysisAI
OpenAI Codex CLI and Codex Desktop's PowerShell command-safety parser failed to recognize PowerShell's stop-parsing token (--%), misclassifying file-writing Git commands embedded after that token as safe and executing them without user approval. An attacker who tricks a developer into opening a crafted repository can cause Codex to silently write an attacker-controlled configuration; when Codex subsequently loads that configuration, it launches an attacker-designated MCP server and executes arbitrary code under the user's account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must prepare a repository with instructions that use PowerShell's stop-parsing token (--%) to smuggle arguments past Codex's command classifier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) reflects a worst-case Windows scenario where PowerShell is built-in and the full attack chain completes without additional prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Codex CLI to a version above 0.130.0, Codex Desktop to a version above 26.513.40821 (or 26.513.31313 for the earlier branch), and the Codex Desktop Microsoft Store package to a version above 26.513.4821.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, alert all development teams using OpenAI Codex (CLI or Desktop) to avoid opening repositories from untrusted sources and consider disabling Codex for untrusted repository operations until guidance is available. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Codex Desktop
View allArbitrary code execution in OpenAI Codex Desktop (Windows and macOS, including the Microsoft Store package) occurs when
Arbitrary code execution in OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) allows an attack
Arbitrary code execution in OpenAI Codex Desktop for Windows and macOS allows an attacker's Git hooks to run outside the
Share
External POC / Exploit Code
Leaving vuln.today