CVE-2026-19591: OpenAI Codex Privilege Escalation Vulnerability

CVE-2026-19591 Overview

OpenAI Codex CLI and Codex Desktop contain a command-safety parser flaw that misinterprets PowerShell's stop-parsing token (--%). The parser evaluates commands differently than PowerShell itself, allowing attacker-crafted repository instructions to bypass user approval prompts. An attacker who convinces a user to open a malicious repository can trigger a file-writing Git command without approval. Successful exploitation modifies Codex's configuration, which can later launch an attacker-controlled Model Context Protocol (MCP) server and execute code with the user's privileges. The flaw is classified under CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences).

Critical Impact
Attackers can bypass Codex's command approval mechanism to modify configuration files and execute arbitrary code with the user's privileges through an attacker-controlled MCP server.

Affected Products

OpenAI Codex CLI for Windows, macOS, and Linux
OpenAI Codex Desktop for Windows
OpenAI Codex Desktop for macOS

Discovery Timeline

2026-09-01 - CVE-2026-19591 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-19591

Vulnerability Analysis

The vulnerability arises from a semantic mismatch between Codex's command-safety parser and PowerShell's own command interpreter. Codex parses shell commands to determine whether they are safe to execute without user approval. PowerShell supports a stop-parsing token (--%) that instructs the shell to pass all remaining arguments literally to the target program. Codex's parser interprets tokens after --% differently than PowerShell does at runtime, creating a parser differential.

When an attacker-prepared repository instructs Codex to invoke a PowerShell command containing --%, Codex's parser evaluates the command as benign. PowerShell then executes a different, attacker-intended command. This includes file-writing Git operations that can overwrite Codex's configuration file on disk.

Once the configuration is modified, subsequent Codex sessions can load an attacker-controlled MCP server definition. The MCP server runs with the user's privileges and can read, modify, or delete any file accessible to that account. On macOS and Linux, exploitation requires PowerShell Core (pwsh) to be separately installed and invoked.

Root Cause

The root cause is improper neutralization of PowerShell's stop-parsing sequence in Codex's command classifier. The classifier's tokenization diverges from PowerShell's actual parsing rules, allowing crafted commands to be misclassified as safe.

Attack Vector

Exploitation requires user interaction. A victim must open a repository containing attacker-controlled Codex instructions. The attacker crafts PowerShell commands using the --% token to bypass the safety parser. If filesystem sandboxing permits the write, Codex's configuration is overwritten. The default filesystem sandbox on macOS and Linux can block writes outside permitted locations, limiting impact in those environments.

See the OpenAI Codex Pull Request for technical details on the fix.

Detection Methods for CVE-2026-19591

Indicators of Compromise

Unexpected modifications to the Codex configuration file, particularly entries defining new MCP server endpoints
Invocation of pwsh or powershell.exe by the Codex process with command strings containing the --% token
Outbound network connections from Codex to unrecognized MCP server hosts
Git commands executed by Codex that write to files outside the active repository working tree

Detection Strategies

Monitor process trees where the Codex CLI or Desktop binary spawns pwsh or powershell.exe with arguments containing --%
Enable file integrity monitoring on Codex configuration directories to alert on unauthorized changes
Inspect repository content for AGENTS.md or similar instruction files referencing PowerShell stop-parsing sequences

Monitoring Recommendations

Log all child processes spawned by Codex and forward telemetry to a centralized data lake for correlation
Alert on MCP server launches that reference binaries or hosts not on an approved allowlist
Track Git write operations initiated by Codex against paths outside the repository root

How to Mitigate CVE-2026-19591

Immediate Actions Required

Upgrade Codex CLI and Codex Desktop to the fixed release referenced in the OpenAI Codex Pull Request 22643
Avoid opening untrusted repositories in Codex until the update is applied
Review the Codex configuration file for unauthorized MCP server entries and remove any that were not added by the user
On macOS and Linux, verify that filesystem sandboxing is enabled and configured to block writes outside permitted directories

Patch Information

OpenAI addressed the parser differential in the Codex repository. Refer to the OpenAI Codex Pull Request 22643 for the corrected parsing logic. Users should update to the release incorporating this fix.

Workarounds

Uninstall or disable PowerShell Core (pwsh) on macOS and Linux systems where it is not required, removing the exploitation prerequisite
Restrict Codex to trusted repositories through organizational policy and code review of repository instruction files
Enable strict approval prompts for all shell command execution within Codex where the option is available
Isolate Codex usage to sandboxed development environments with limited filesystem access

bash

# Verify PowerShell Core presence on macOS/Linux and remove if unused
which pwsh
# On macOS with Homebrew
brew uninstall --cask powershell
# On Linux (Debian/Ubuntu)
sudo apt-get remove powershell