EUVD-2026-69395
GHSA-hcf6-9q9g-xx3c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires the victim to open an attacker-delivered local repo with intact .git/config (UI:R, AV:L), then code runs with full user privileges giving C/I/A:H.
Primary rating from Vendor (OAI).
CVSS VectorVendor: OAI
Lifecycle Timeline
5DescriptionCVE.org
OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.
AnalysisAI
Arbitrary code execution in OpenAI Codex Desktop (Windows and macOS, including the Microsoft Store package) occurs when a user opens a workspace containing an attacker-prepared Git repository whose local .git/config is intact. Because Codex automatically inspects Git metadata and working-tree status on open, a malicious attr.tree setting combined with a clean/process filter causes Git to launch an attacker-controlled program outside Codex's command sandbox, with the signed-in user's privileges and no trust prompt, approval, or model interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires all of the following: Git must be present on the system PATH; the victim must open, as a Codex workspace, an attacker-prepared repository whose local .git/config is preserved intact (attr.tree plus a configured clean or process filter). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS is 9.8 with AV:N/AC:L/PR:N/UI:N, but the description contradicts UI:N and AV:N: exploitation explicitly requires the victim to open an attacker-prepared repository with its local Git configuration intact, and a normal git clone does NOT reproduce the condition because it discards the source .git/config. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Codex Desktop to a build above the affected ranges listed in EUVD-2026-69395 (i.e., beyond 26.513.31313 for the standard build, beyond 26.513.4821.0 for the Microsoft Store package, and beyond 26.513.40821 for the 26.304.38 line); the version-range upper bounds indicate a vendor fix exists above them, though an exact single patched version string is not stated in the provided data - confirm the current release via OpenAI's advisory at https://openai.com/codex before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all Codex Desktop installations (Windows, macOS, and Microsoft Store versions) across your organization and immediately notify all users to cease opening Git repositories from external, untrusted, or community sources; restrict Codex Desktop usage to internal repositories only pending further mitigation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Codex Desktop
View allOpenAI Codex CLI and Codex Desktop's PowerShell command-safety parser failed to recognize PowerShell's stop-parsing toke
Arbitrary code execution in OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) allows an attack
Arbitrary code execution in OpenAI Codex Desktop for Windows and macOS allows an attacker's Git hooks to run outside the
Share
External POC / Exploit Code
Leaving vuln.today