CVE-2026-19590: OpenAI Codex Desktop RCE Vulnerability

CVE-2026-19590 Overview

OpenAI Codex Desktop for Windows and macOS contains a vulnerability that allows execution of attacker-controlled Git hooks during automated Git operations. The flaw exists because Codex trusts the repository's local core.hooksPath setting without validation. When a user opens an attacker-prepared repository containing a preserved .git/config file that redirects core.hooksPath to an attacker-controlled directory, Codex executes malicious hook scripts while processing the repository. The hook runs outside Codex's command sandbox, without user approval, and with the user's privileges. This vulnerability is classified as [CWE-427] Uncontrolled Search Path Element.

Critical Impact
Attacker-controlled Git hooks execute outside the Codex sandbox with the user's privileges, enabling arbitrary file read, modification, deletion, and access to user resources.

Affected Products

OpenAI Codex Desktop for Windows
OpenAI Codex Desktop for macOS
Codex automated Git operation workflows

Discovery Timeline

2026-09-01 - CVE-2026-19590 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-19590

Vulnerability Analysis

The vulnerability resides in how Codex Desktop performs automated Git operations against user-supplied repositories. Git supports a per-repository core.hooksPath configuration setting that specifies where hook scripts live. When Codex processes a repository, its Git operations honor this setting and execute hooks from the attacker-designated directory. Because the hook process runs outside the Codex command sandbox, none of the tool's approval prompts or execution constraints apply. The attacker gains code execution with the same privileges as the local user account.

Root Cause

The root cause is uncontrolled trust in repository-local Git configuration. Codex reads and applies the core.hooksPath value from .git/config without validating whether the target directory is safe or explicitly approved by the user. This produces a search-path control weakness aligned with [CWE-427], where an untrusted configuration file directs code execution to attacker-supplied binaries or scripts.

Attack Vector

Exploitation requires the victim to open an attacker-prepared repository in Codex Desktop. A standard git clone operation does not preserve the repository-local configuration required for the attack, so the attacker must deliver the repository as an archive, disk image, or filesystem copy that retains .git/config and the hooks directory intact. Once the user opens the repository, Codex triggers Git operations, which execute the attacker's pre-commit, post-checkout, or similar hook. The hook can read user files, exfiltrate data, install persistence, or modify local resources. The attack requires user interaction and local access, but no additional privileges beyond a standard user session.

See the OpenAI Codex Pull Request for the upstream fix and technical discussion.

Detection Methods for CVE-2026-19590

Indicators of Compromise

Presence of .git/config files containing a core.hooksPath entry pointing outside the standard .git/hooks directory
Executable scripts in non-standard hook directories bundled inside repository archives received from untrusted sources
Unexpected child processes spawned by the Codex Desktop process during repository open or refresh operations

Detection Strategies

Inspect newly opened repositories for core.hooksPath overrides before permitting Codex to process them
Monitor process creation events where the Codex Desktop binary spawns shell interpreters, scripting engines, or binaries from user-writable paths
Correlate file access anomalies with Codex Desktop process activity to identify hook-driven data collection

Monitoring Recommendations

Enable endpoint process telemetry on developer workstations running Codex Desktop and alert on Git hook executions from paths outside .git/hooks
Log and review repository imports, archive extractions, and disk image mounts that precede Codex sessions
Track outbound network connections initiated by processes descended from Codex Desktop that do not match expected Git or API endpoints

How to Mitigate CVE-2026-19590

Immediate Actions Required

Update OpenAI Codex Desktop to the version incorporating the fix referenced in Codex Pull Request 22843
Avoid opening repositories delivered as archives, disk images, or filesystem copies from untrusted sources
Audit existing local repositories for core.hooksPath values redirecting to non-standard directories

Patch Information

OpenAI addressed the issue in the Codex repository through Codex Pull Request 22843. Users should upgrade to the Codex Desktop release that includes this change. The fix constrains how Codex handles repository-local hook path configuration during automated Git operations.

Workarounds

Set a global Git configuration that overrides core.hooksPath to a trusted directory: git config --global core.hooksPath ~/.git-hooks-trusted
Extract untrusted repository archives in an isolated virtual machine or container before inspecting them with Codex Desktop
Manually remove or inspect .git/config and the referenced hooks directory in any repository received outside a normal git clone workflow

bash

# Inspect a repository for a suspicious hooksPath override before opening it in Codex
grep -R "hooksPath" .git/config

# Enforce a trusted global hooks directory
git config --global core.hooksPath "$HOME/.git-hooks-trusted"