EUVD-2026-69396
GHSA-26wp-42v3-96xp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconDeliver crafted repository archive with malicious .git/config
-
DeliveryVictim extracts archive, preserving .git/config intact
-
ExploitVictim opens repository in Codex CLI or Desktop
-
InstallCodex triggers automated Git metadata collection
-
C2Git reads core.fsmonitor from repository-local .git/config
-
ExecuteGit invokes attacker-controlled fsmonitor helper
-
ImpactAttacker code executes with victim's user privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration Configuration hardening
|
| Exploitation Conditions | Three specific conditions must all be met: (1) Codex CLI or Codex Desktop must be used to open or interact with a repository directory; (2) the repository's .git/config must contain a core.fsmonitor entry pointing to an attacker-controlled executable that is accessible on the victim's filesystem (typically bundled within the repository directory itself); (3) the repository must have been delivered with .git/config intact - ordinary git clone from a remote explicitly does NOT preserve the source repository's local .git/config, so cloned repositories are not exploitable. Exploitation is limited to repositories delivered via archive files (zip, tar, direct directory copy), attacker-hosted git servers that serve local config, or physical/network share access. The attacker-supplied executable must also be reachable at its configured path at the moment Codex triggers metadata collection. |
| Impact | The CVSS 7.3 base score with vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H is well-calibrated for this vulnerability: exploitation is local, requires user interaction (opening the repository), and has no scope change, but once those conditions are met the code execution is fully automatic with complete read, write, and delete impact on user-accessible resources. The EPSS score of 0.14% at the 4th percentile accurately reflects the prerequisite friction - an attacker must deliver a repository archive with its .git/config preserved, which standard git clone does not do. The absence from CISA KEV and the lack of identified public exploit code are consistent with this low exploitation probability. The combination of low-EPSS, non-KEV, and a non-trivial delivery constraint positions this as a targeted rather than opportunistic threat; development teams that regularly receive repository archives from external or community sources face meaningfully higher exposure than those that only clone from trusted remotes. |
| Exploit ScenarioDerived | An attacker packages a repository as a zip or tar archive, including a .git/config that sets core.fsmonitor to a malicious shell script bundled in the repository directory. When the victim extracts the archive and opens the directory in Codex CLI or Codex Desktop, Codex automatically runs Git status commands to collect metadata; Git reads core.fsmonitor from .git/config and invokes the attacker's script with the victim's user privileges, potentially exfiltrating credentials, modifying source files, or establishing persistence. No public exploit code has been identified, but the technique is straightforward for an attacker familiar with Git's local configuration model. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Arbitrary code execution in OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) allows an attacker who can deliver a crafted repository archive to run code with the victim user's full privileges when Codex automatically collects Git repository metadata. The root cause is that Codex's Git metadata collection path did not suppress the repository-local core.fsmonitor configuration, enabling a malicious .git/config to direct Git to invoke an attacker-supplied filesystem-monitor helper outside Codex's command sandbox and without any user-approval prompt. OpenAI has issued a source-level fix via PR #22652 adding -c core.fsmonitor=false to the relevant Git invocations; no public exploit code has been identified at time of analysis.
RemediationAI
Upgrade Codex CLI beyond version 0.130.0 and Codex Desktop beyond version 26.513.40821 (or 26.513.4821.0 for the Microsoft Store package) once OpenAI publishes releases incorporating PR #22652 from https://github.com/openai/codex/pull/22652. The fix passes -c core.fsmonitor=false to all Git metadata collection invocations, preventing the repository-local .git/config from influencing command execution. As an immediate workaround before patching is available, avoid opening repository directories received as archives (zip, tar, direct directory copy) from untrusted or unverified sources, since this is the only delivery mechanism that preserves a malicious .git/config. Developers who must process externally supplied archives should inspect the .git/config of any received repository for a core.fsmonitor key and remove it before opening the repository in Codex. Standard git clone from a remote URL is not a viable attack vector and requires no additional precautions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Git's core.fsmonitor configuration key designates an external helper program that Git invokes to efficiently determine which files have changed, bypassing full filesystem scans on large repositories. This setting can reside in a repository-local .git/config file and is normally scoped to that repository. OpenAI Codex CLI (implemented in Rust under codex-rs/git-utils) and Codex Desktop automatically invoke Git status commands to collect repository metadata when a user opens or interacts with a project. Prior to the fix, these Git invocations inherited the repository's local configuration verbatim, including any attacker-set core.fsmonitor value. CWE-15 (External Control of System or Configuration Setting) is the accurate root cause classification: a party external to Codex controls a system-level configuration that Codex then acts on without sanitization. Affected CPEs are cpe:2.3:a:openai:codex_cli and cpe:2.3:a:openai:codex_desktop across all supported platforms, plus cpe:2.3:a:openai:codex_desktop_(microsoft_store_package) for the Windows Store distribution. The fix confirmed in PR #22652 adds the flag -c core.fsmonitor=false directly to the git argument list in codex-rs/git-utils/src/info.rs, overriding any repository-local setting.
Know when Codex Cli gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Repository must be locally opened by the user (AV:L, UI:R); once opened, exploitation is automatic with full user-level read/write/delete impact and no scope change.
Primary rating from Vendor (OAI).
CVSS VectorVendor: OAI
Lifecycle Timeline
3DescriptionCVE.org
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git can execute that helper while Codex collects repository metadata. The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges. The code can read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the source repository's local .git/config; exploitation requires a repository delivered or copied with that configuration intact.
Zero Day Initiative Advisories
Executive ViewAI
OpenAI Codex CLI and Desktop applications are vulnerable to arbitrary code execution when developers open malicious Git repositories. When Codex automatically collects Git repository metadata, a crafted .git/config file can execute arbitrary code with the developer's full system privileges without any user approval prompt. This supply-chain risk threatens development environments and potentially propagates compromised code into downstream projects.
No vendor-released patch identified at time of analysis. Mitigations include: restrict Codex to internal repositories; implement code review and repository vetting before external repo access; disable Git metadata collection if available in Codex settings; segregate Codex to lower-privilege user accounts or development VMs where feasible; monitor for unexpected process execution from Codex on developer systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB