CVE-2026-19592: OpenAI Codex CLI RCE Vulnerability

CVE-2026-19592 Overview

CVE-2026-19592 affects OpenAI Codex CLI on Windows, macOS, and Linux, and Codex Desktop on Windows and macOS. The tools automatically collect Git repository metadata without disabling the repository-local core.fsmonitor setting. When a user opens an attacker-prepared repository containing a preserved .git/config, Git executes the attacker-controlled filesystem-monitor helper during metadata collection. The helper runs outside the Codex command sandbox and without a user-approval prompt. Attacker-controlled code then executes with the user's privileges, allowing file access, modification, deletion, and access to other user resources.

Critical Impact
Attacker-controlled code executes with the user's privileges outside the Codex sandbox and without user approval, bypassing Codex's command approval safeguards.

Affected Products

OpenAI Codex CLI for Windows, macOS, and Linux
OpenAI Codex Desktop for Windows
OpenAI Codex Desktop for macOS

Discovery Timeline

2026-09-01 - CVE-2026-19592 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-19592

Vulnerability Analysis

The flaw involves how Codex interacts with Git during automatic repository metadata collection. Codex invokes Git operations against user-opened repositories but does not disable the repository-local core.fsmonitor configuration. Git's core.fsmonitor setting specifies an external filesystem-monitor helper program that Git launches to accelerate status queries. When Codex reads repository metadata, Git spawns the configured helper. The helper executes outside Codex's command sandbox and does not trigger the user-approval prompt that normally gates command execution. This categorizes as an External Control of System or Configuration Setting weakness [CWE-15].

Root Cause

Codex trusts repository-local Git configuration when collecting metadata. The core.fsmonitor value is a trusted execution path in Git, but Codex treats it as inert configuration data. Codex fails to override or unset core.fsmonitor before invoking Git, allowing attacker-defined helper binaries or scripts to execute as a side effect of metadata reads.

Attack Vector

Exploitation requires a repository delivered or copied to the victim with its .git/config intact. A standard git clone does not preserve the source repository's local configuration, so ordinary cloning is not a viable delivery mechanism. Attackers must distribute the repository as an archive such as a zip or tarball, a USB drop, a network share, or another method that preserves .git/config. When the user opens the repository in Codex CLI or Codex Desktop, Codex triggers Git operations. Git reads the attacker-supplied core.fsmonitor value and executes the referenced helper with the user's privileges. The helper can read, modify, or delete user files and access any resource available to the user's account.

No verified public exploit code is available. See the GitHub Pull Request for Codex for the upstream fix details.

Detection Methods for CVE-2026-19592

Indicators of Compromise

Unexpected child processes spawned by git or Codex processes referencing filesystem-monitor helper paths.
Presence of core.fsmonitor entries in .git/config files of repositories received from external or untrusted sources.
Repositories delivered as archives, USB media, or shared folders with preserved .git/ directories containing non-default configuration.

Detection Strategies

Scan repositories on developer endpoints for .git/config files containing a core.fsmonitor setting and flag any that point to unexpected binaries or scripts.
Monitor Codex CLI and Codex Desktop process trees for child processes not on an approved list of Git helpers.
Alert on Codex processes spawning executables from user-writable paths such as repository directories, temporary folders, or user profile locations.

Monitoring Recommendations

Log Git configuration reads and helper invocations on developer workstations for post-incident review.
Track file creation, modification, and deletion patterns immediately following Codex repository open events.
Correlate archive extraction events with subsequent Codex activity to surface preserved .git/config risks.

How to Mitigate CVE-2026-19592

Immediate Actions Required

Update OpenAI Codex CLI and Codex Desktop to the fixed release referenced in the Codex pull request.
Instruct developers to avoid opening repositories received as archives or copies from untrusted sources until patched builds are deployed.
Audit developer workstations for existing .git/config files containing core.fsmonitor entries pointing to unexpected helpers.

Patch Information

The upstream fix is tracked in the OpenAI Codex repository pull request #22652. The change disables or overrides the repository-local core.fsmonitor setting when Codex collects repository metadata, preventing Git from executing attacker-controlled helper binaries during that operation.

Workarounds

Set a global Git override that disables filesystem monitoring: git config --global core.fsmonitor false.
Inspect .git/config and remove any core.fsmonitor entry before opening third-party repositories in Codex.
Restrict repository transfer methods to git clone from trusted remotes, since cloning does not preserve source-local .git/config.

bash

# Configuration example: disable fsmonitor globally and inspect untrusted repos
git config --global core.fsmonitor false
grep -R "fsmonitor" path/to/untrusted-repo/.git/config