CVE-2026-19590 json
OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the reposit…
published 2026-09-01 2 mo ago modified 2026-09-03 2 mo ago also EUVD-2026-69393
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 4%
- public exploits
- 0
- none known
Summary
OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.
Patch / fix
- OpenAI Codex Desktop 26.519.21041, 26.519.22136
- OpenAI Codex Desktop (Microsoft Store package) 26.519.2081.0
- github.com/openai/codex#22843 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 mo ago
Exploit prediction
0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected products
- OpenAI Codex Desktop
- OpenAI Codex Desktop (Microsoft Store package)
Classification
- Weakness
-
- CWE-427 Uncontrolled Search Path Element
References
Sources
- CVE List CVE-2026-19590
- NVD CVE-2026-19590
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.