EUVD-2026-69396
GHSA-26wp-42v3-96xp
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Repository must be locally opened by the user (AV:L, UI:R); once opened, exploitation is automatic with full user-level read/write/delete impact and no scope change.
Primary rating from Vendor (OAI).
CVSS VectorVendor: OAI
Lifecycle Timeline
6DescriptionCVE.org
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git can execute that helper while Codex collects repository metadata. The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges. The code can read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the source repository's local .git/config; exploitation requires a repository delivered or copied with that configuration intact.
AnalysisAI
Arbitrary code execution in OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) allows an attacker who can deliver a crafted repository archive to run code with the victim user's full privileges when Codex automatically collects Git repository metadata. The root cause is that Codex's Git metadata collection path did not suppress the repository-local core.fsmonitor configuration, enabling a malicious .git/config to direct Git to invoke an attacker-supplied filesystem-monitor helper outside Codex's command sandbox and without any user-approval prompt. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must all be met: (1) Codex CLI or Codex Desktop must be used to open or interact with a repository directory; (2) the repository's .git/config must contain a core.fsmonitor entry pointing to an attacker-controlled executable that is accessible on the victim's filesystem (typically bundled within the repository directory itself); (3) the repository must have been delivered with .git/config intact - ordinary git clone from a remote explicitly does NOT preserve the source repository's local .git/config, so cloned repositories are not exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.3 base score with vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H is well-calibrated for this vulnerability: exploitation is local, requires user interaction (opening the repository), and has no scope change, but once those conditions are met the code execution is fully automatic with complete read, write, and delete impact on user-accessible resources. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Codex CLI beyond version 0.130.0 and Codex Desktop beyond version 26.513.40821 (or 26.513.4821.0 for the Microsoft Store package) once OpenAI publishes releases incorporating PR #22652 from https://github.com/openai/codex/pull/22652. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict Codex usage to trusted internal repositories only and distribute a security alert to all Codex users instructing them to avoid opening untrusted external repositories or clones from unfamiliar sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Codex Desktop
View allArbitrary code execution in OpenAI Codex Desktop (Windows and macOS, including the Microsoft Store package) occurs when
OpenAI Codex CLI and Codex Desktop's PowerShell command-safety parser failed to recognize PowerShell's stop-parsing toke
Arbitrary code execution in OpenAI Codex Desktop for Windows and macOS allows an attacker's Git hooks to run outside the
Share
External POC / Exploit Code
Leaving vuln.today