CVE-2026-19590

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/openai/codex/pull/22843

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-01 18:17

Updated : 2026-09-03 15:17

NVD link : CVE-2026-19590

Mitre link : CVE-2026-19590

CVE.ORG link : CVE-2026-19590

JSON object : View

Products Affected

No product.

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2026-19590", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19590", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-03T14:29:12.027630Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "affected": [{"source": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7", "affectedData": [{"vendor": "OpenAI", "product": "Codex Desktop", "versions": [{"status": "affected", "version": "260202.0859", "versionType": "custom", "lessThanOrEqual": "26.513.31313"}, {"status": "unaffected", "version": "26.519.22136"}], "platforms": ["macOS"]}, {"vendor": "OpenAI", "product": "Codex Desktop", "versions": [{"status": "affected", "version": "26.304.38", "versionType": "custom", "lessThanOrEqual": "26.513.40821"}, {"status": "unaffected", "version": "26.519.21041"}], "platforms": ["Windows"]}, {"vendor": "OpenAI", "product": "Codex Desktop (Microsoft Store package)", "versions": [{"status": "affected", "version": "26.304.38.0", "versionType": "custom", "lessThanOrEqual": "26.513.4821.0"}, {"status": "unaffected", "version": "26.519.2081.0"}], "platforms": ["Windows"]}]}], "published": "2026-09-01T18:17:40.140", "references": [{"url": "https://github.com/openai/codex/pull/22843", "source": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation."}], "lastModified": "2026-09-03T15:17:19.780", "sourceIdentifier": "8f4f43ab-ba69-4d92-aa1d-d772184d6fb7"}