What is the CVSS score of CVE-2026-19593?

CVE-2026-19593 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-19593?

Within 24 hours: Audit all Codex Desktop installations (Windows, macOS, and Microsoft Store versions) across your organization and immediately notify all users to cease opening Git repositories from external, untrusted, or community sources; restrict Codex Desktop usage to internal repositories only pending further mitigation. Within 7 days: Implement mandatory pre-opening repository verification workflows and require code review before opening any workspace in Codex Desktop; deploy endpoint detection and response (EDR) monitoring with alerts for unexpected child process execution from Codex Desktop processes; evaluate and transition security-critical development workflows to alternative development tools without Git-based code execution vulnerabilities. Within 30 days: Monitor OpenAI security advisories and vendor communications for patch availability; upon patch release, validate the update in a controlled test environment before staged deployment; conduct forensic review of systems that opened external repositories to detect potential credential theft, unauthorized code commits, or persistence mechanisms.

Codex Desktop CVE-2026-19593

EUVD-2026-69395 CRITICAL

External Control of System or Configuration Setting (CWE-15)

2026-09-01 OAI

GHSA-hcf6-9q9g-xx3c

Apple Microsoft Codex Desktop Codex Desktop Microsoft Store Package Openai

9.8

CVSS 3.1 · Vendor: OAI

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft repo with malicious .git/config filter
Delivery

Deliver archive preserving local config
Exploit

Victim opens workspace in Codex Desktop
Execution

Codex auto-inspects Git status
Persist

Git runs attacker filter program
Impact

Code executes as user outside sandbox

Vulnerability Assessment

Weakness	CWE CWE-15 OWASP Top 10:2025 A02:2025 - Security Misconfiguration ASVS 5.0 V13 - Configuration Configuration hardening
Exploitation Conditions	Requires all of the following: Git must be present on the system PATH; the victim must open, as a Codex workspace, an attacker-prepared repository whose local .git/config is preserved intact (attr.tree plus a configured clean or process filter). Delivery cannot be a normal git clone, because cloning does not copy the source repository's .git/config - the attacker must ship the repo as an archive/directory copy that retains the malicious config. Limiting factors: user must actively open the malicious workspace (user interaction), and the specific Git filter configuration must survive delivery; there is no authentication requirement (PR:N) and no model interaction or trust prompt is triggered once opened.
Impact	The published CVSS is 9.8 with AV:N/AC:L/PR:N/UI:N, but the description contradicts UI:N and AV:N: exploitation explicitly requires the victim to open an attacker-prepared repository with its local Git configuration intact, and a normal git clone does NOT reproduce the condition because it discards the source .git/config. That means an attacker must deliver the repo as an archive/copy that preserves .git/config, and the user must actively open it - so user interaction is genuinely required and the delivery is closer to a malicious-file scenario than a remote unauthenticated network attack. I assess a more realistic score near 7.7 (AV:L/UI:R). Supporting signals are consistent with lower urgency than the 9.8 implies: EPSS is 0.14% (4th percentile), not in CISA KEV, and no POC is referenced. The technical impact is high (full code execution as the user, sandbox bypass), but automatability is limited by the required user action and the non-trivial delivery constraint. Net: real and serious when triggered, but not mass-exploitable - the 9.8 overstates network/no-interaction ease.
Exploit ScenarioDerived	An attacker crafts a Git repository whose .git/config sets attr.tree and a process/clean filter pointing at a malicious binary, then delivers it to a developer as a zip or shared folder (not a clonable remote, to preserve the config). When the developer opens that folder as a workspace in Codex Desktop, Codex automatically reads Git status, Git invokes the filter, and the attacker's program runs with the user's privileges outside the Codex sandbox - stealing credentials or planting malware. No POC is currently published.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 02, 2026

Arbitrary code execution in OpenAI Codex Desktop (Windows and macOS, including the Microsoft Store package) occurs when a user opens a workspace containing an attacker-prepared Git repository whose local .git/config is intact. Because Codex automatically inspects Git metadata and working-tree status on open, a malicious attr.tree setting combined with a clean/process filter causes Git to launch an attacker-controlled program outside Codex's command sandbox, with the signed-in user's privileges and no trust prompt, approval, or model interaction. No public exploit is identified at time of analysis and EPSS is low (0.14%), but the outcome is full local compromise of the user's files and credentials.

RemediationAI

Upgrade Codex Desktop to a build above the affected ranges listed in EUVD-2026-69395 (i.e., beyond 26.513.31313 for the standard build, beyond 26.513.4821.0 for the Microsoft Store package, and beyond 26.513.40821 for the 26.304.38 line); the version-range upper bounds indicate a vendor fix exists above them, though an exact single patched version string is not stated in the provided data - confirm the current release via OpenAI's advisory at https://openai.com/codex before deploying. As compensating controls until patched: do not open repositories received from untrusted sources as pre-packaged archives or copies (only clone from trusted remotes, since cloning strips the malicious .git/config); if feasible, remove Git from the system PATH visible to Codex, since the description states exploitation requires Git to be available on PATH (trade-off: this breaks Codex's Git integration entirely); and inspect any third-party repository's .git/config for attr.tree, clean, or process filter directives before opening it in the tool.

Affected VersionsENISA

Codex Desktop 260202.0859 ≤26.513.31313

Codex Desktop (Microsoft Store package) 26.304.38.0 ≤26.513.4821.0

Codex Desktop 26.304.38 ≤26.513.40821

Affected Packages

euvd codex_desktop no fix

euvd codex_desktop_microsoft_store_package no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw abuses Git's filter/attributes mechanism rather than a memory-safety bug. CWE-15 (External Control of System or Configuration Setting) fits precisely: the attacker controls Git configuration values delivered inside the repository's own .git/config. Git's attr.tree setting plus a configured clean or process filter tells Git to run an external program during routine operations such as reading working-tree status. Codex Desktop performs exactly those operations automatically when a workspace opens, so the attacker-controlled filter program executes. Critically, this execution happens outside Codex's command sandbox - the layer that normally requires workspace-trust prompts and command approval - so the malicious binary runs with the full ambient privileges of the signed-in OS user. Affected CPEs are cpe:2.3:a:openai:codex_desktop and the openai:codex_desktop_(microsoft_store_package) variant across Windows and macOS builds.

Know when Codex Desktop gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (OAI) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Requires the victim to open an attacker-delivered local repo with intact .git/config (UI:R, AV:L), then code runs with full user privileges giving C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (OAI).

CVSS VectorVendor: OAI

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 02, 2026 - 18:22 NVD

9.8 (CRITICAL)

CVE Published

Sep 01, 2026 - 17:10 cve.org

CRITICAL 9.8

CVE Published

Sep 01, 2026 - 17:10 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.

Zero Day Initiative Advisories

ZDI-26-651 OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability Sep 2026

Executive ViewAI

Why It Matters

OpenAI Codex Desktop for Windows and macOS contains a critical arbitrary code execution vulnerability triggered when users open workspaces containing malicious Git repositories. An attacker can execute code with the user's full system privileges without any warning, prompt, or user action beyond opening a workspace, potentially compromising developer credentials, source code, and sensitive files. Every signed-in Codex Desktop user is at risk when opening Git repositories from untrusted or compromised sources.

Business Impact: Severe

Compensating Controls

Until vendor patch is released: restrict Codex Desktop to internal, pre-vetted Git repositories only with mandatory access controls; implement strict code signing and Git configuration policies to prevent unauthorized filter configuration; enable host-based monitoring and alerting for child process spawning from Codex Desktop; provide developer education on repository provenance and verification; consider temporary removal of Codex Desktop from systems accessing sensitive credentials, intellectual property, or production environments.

Threat Intelligence Overview

EPSS Score

0.1%

Top 96% exploitable

Prevalence

Low

niche developer desktop client, limited install base despite OpenAI brand

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.