CVE-2026-19593: OpenAI Codex Desktop RCE Vulnerability

CVE-2026-19593 Overview

CVE-2026-19593 affects OpenAI Codex Desktop for Windows and macOS. The application automatically inspects Git metadata and working-tree status when a user opens a workspace. If the workspace contains a repository with an attacker-controlled .git/config, Git can execute an attacker-supplied program through the attr.tree setting combined with a configured clean or process filter. The program runs outside Codex's command sandbox with the signed-in user's privileges. No workspace-trust prompt, command approval, or model interaction occurs. Attackers can read, modify, or delete files and access user-accessible credentials. This weakness is categorized under [CWE-15] (external control of system or configuration setting).

Critical Impact
Opening a prepared repository triggers arbitrary code execution outside Codex's sandbox with the signed-in user's privileges and without any trust prompt.

Affected Products

OpenAI Codex Desktop for Windows
OpenAI Codex Desktop for macOS
Systems where Git is available on PATH and the local .git/config remains intact

Discovery Timeline

2026-09-01 - CVE-2026-19593 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-19593

Vulnerability Analysis

Codex Desktop scans repository metadata as soon as a user opens a workspace. That scan invokes Git operations that honor the repository's local .git/config. An attacker who ships a repository directory (not a fresh clone) with a preserved .git/config controls those Git settings. Git's attr.tree directive combined with a filter.<name>.clean or filter.<name>.process entry causes Git to execute an attacker-defined binary or shell command during attribute resolution. Codex performs this work automatically, bypassing the workspace-trust prompt and command-approval flow that normally gate command execution. The executed process inherits the interactive user's token, so it can touch any file, credential store, SSH key, or cloud token accessible to that account.

Root Cause

Codex Desktop treats freshly opened workspaces as safe enough to run Git introspection commands before any user consent. Git, in turn, trusts the repository-local configuration. The combination allows repository content to control process execution on the host, an instance of external control of a configuration setting [CWE-15].

Attack Vector

An attacker delivers a repository directory with an intact .git/config through a shared archive, removable media, network share, or supply-chain distribution channel. When the target opens that directory in Codex Desktop, the automatic Git inspection triggers the malicious filter. An ordinary git clone does not copy the source .git/config, so the attack requires the victim to receive the working tree with its local Git state preserved. Exploitation also requires Git to be reachable on PATH.

Vulnerability mechanism (prose description):
1. Attacker prepares repository containing .git/config with:
   - attr.tree pointing to an attacker-controlled tree
   - filter.<name>.clean or filter.<name>.process set to an attacker binary
2. Victim opens the directory as a workspace in Codex Desktop.
3. Codex Desktop runs Git metadata and status inspection automatically.
4. Git resolves attributes, invokes the configured filter program.
5. Filter executes outside Codex's sandbox as the signed-in user.

Detection Methods for CVE-2026-19593

Indicators of Compromise

Unexpected child processes of the Codex Desktop application spawning shells, git.exe, or interpreter binaries such as powershell.exe, cmd.exe, bash, or python.
Presence of filter.*.clean, filter.*.process, or attr.tree entries in .git/config files inside workspaces received from external sources.
Access to credential stores, SSH private keys, or cloud CLI token files shortly after a workspace is opened.

Detection Strategies

Alert on process lineage where Codex Desktop or its helper processes spawn Git followed by non-Git executables.
Scan repositories staged in user directories for .git/config files containing filter. or attr.tree directives that reference external programs.
Monitor for outbound network connections initiated by child processes of Codex Desktop shortly after workspace open events.

Monitoring Recommendations

Enable command-line and process-creation logging (Windows Event ID 4688 with command line, macOS Endpoint Security exec events) on developer endpoints.
Forward endpoint telemetry to a centralized data lake and correlate workspace-open events with subsequent process executions.
Track file reads against credential paths such as %APPDATA%\Microsoft\Credentials, ~/.aws/credentials, ~/.ssh/, and browser token stores.

How to Mitigate CVE-2026-19593

Immediate Actions Required

Update OpenAI Codex Desktop to the vendor's fixed release as soon as it is available; consult the OpenAI Codex product page for advisories.
Instruct users to never open repository directories received as archives, shared folders, or removable media inside Codex Desktop until patched.
Audit developer endpoints for repositories that were opened recently and inspect their .git/config files for suspicious filter or attribute directives.

Patch Information

Refer to the OpenAI Codex product page for the current fixed version and vendor guidance. No patch metadata is included in the NVD entry at publication time.

Workarounds

Remove Git from PATH on systems running Codex Desktop until a patched build is deployed; the exploitation chain requires Git to be invokable.
Only open workspaces created locally via git clone, which does not carry over the source .git/config.
Strip or replace .git/config in any externally sourced repository directory before opening it, or open it first in a disposable sandbox or virtual machine.

bash

# Inspect an externally sourced repository before opening it in Codex Desktop
grep -E 'filter\.|attr\.tree|hooksPath' /path/to/repo/.git/config || echo 'No suspicious directives found'

# Neutralize risky settings by replacing the local config
mv /path/to/repo/.git/config /path/to/repo/.git/config.bak
printf '[core]\n\trepositoryformatversion = 0\n' > /path/to/repo/.git/config