On 1 September 2026, four CVEs were published for OpenAI Codex, the coding agent that ships as a CLI and a desktop app. Three describe the same trap: Codex runs Git commands in the background to read repository state, and a repository's local .git/config can tell Git to launch a program that runs outside Codex's command sandbox, with no approval prompt. On 10 September the Zero Day Initiative published ZDI-26-651 for the most severe of the four, a Pwn2Own entry.
What's affected
- CVE-2026-19593, Codex Desktop for Windows and macOS. Trigger:
attr.treeplus a configured clean or process filter, run when a workspace is opened. CVSS 9.8 in the CVE record. - CVE-2026-19591, Codex CLI for Windows, macOS and Linux, and Codex Desktop. Trigger: the PowerShell stop-parsing token, misread by Codex's command-safety parser. CVSS 8.8.
- CVE-2026-19590, Codex Desktop for Windows and macOS. Trigger: a repository-local
core.hooksPathpointing at attacker hooks. CVSS 7.3. - CVE-2026-19592, Codex CLI and Codex Desktop. Trigger: a repository-local
core.fsmonitorhelper. CVSS 7.3.
ZDI scores CVE-2026-19593 at 7.8 and credits Satoki Tsuji of Ikotas Labs. ZDI says it reported the bug to OpenAI on 2 June 2026.
The details matter:
- CVE-2026-19593: Codex Desktop inspected Git metadata and working-tree status as soon as a workspace opened. The record says the attacker's program runs "without a workspace-trust prompt, command approval, or interaction with a model."
- CVE-2026-19590 and CVE-2026-19592: the same idea through Git hooks and the filesystem monitor helper.
- CVE-2026-19591: different mechanism. A prompt-injected repository could get Codex to run a file-writing Git command without asking, because Codex and PowerShell disagreed on how to parse the stop-parsing token. That write could change Codex's own config and make it launch an attacker's MCP server. On macOS and Linux this also needs PowerShell Core installed, and the default filesystem sandbox can block the write.
Fixed versions: the CVE records don't name a release. The linked pull requests for CVE-2026-19590, 19591 and 19592 (openai/codex #22843, #22643 and #22652) were merged on 14 and 15 May 2026. For CVE-2026-19593, ZDI says "OpenAI has issued an update to correct this vulnerability."
The important limit: every record notes that an ordinary git clone does not copy the source repository's .git/config. The attack needs a repository delivered with its .git folder intact, such as a zip or tarball of a project, a copied folder, or a shared drive.
How to check if you're exposed
Check your Codex versions first:
codex --version
npm ls -g @openai/codex 2>/dev/null
Then look for repositories whose local Git config sets any of the keys these CVEs abuse. Reading the file directly is safer than running Git inside an untrusted repo:
grep -nE 'hooksPath|fsmonitor|^\s*tree\s*=|\[filter' path/to/repo/.git/config
To sweep folders where archives and copied projects tend to land:
find ~/Downloads ~/Desktop ~/src -path '*/.git/config' 2>/dev/null \
| xargs grep -lE 'hooksPath|fsmonitor|^\s*tree\s*=|\[filter' 2>/dev/null
Any hit is worth reading. Legitimate setups do use hooks paths and fsmonitor, but they should point at tools you recognize, not at a script inside the project.
What to do now
-
Update Codex CLI and Codex Desktop to the current release on every developer machine. For the CLI installed from npm:
npm install -g @openai/codex@latest -
Re-clone instead of unzipping. When someone sends a project archive, clone the upstream URL fresh, or delete the shipped
.gitfolder and rungit init, before opening it in any agent. -
Audit the config keys above on machines that opened third-party archives before the fixes landed.
-
Keep the default sandbox on. The CVE-2026-19591 record says the default macOS and Linux filesystem sandbox can stop the config write. Turning it off removes that backstop.
-
Treat agent config files as sensitive. Watch for unexpected changes to Codex's config and to the list of MCP servers it launches, since that is where CVE-2026-19591 lands.
Why it matters
None of these bugs needed a clever prompt. CVE-2026-19593 fires before the model sees anything. The agent's own housekeeping, running Git to show you a status badge, became the execution path.
That pattern is not unique to one vendor. Git config, editor settings and tool config files are all executable surfaces. Any coding tool that runs helpers on open inherits whatever those files say. Approval prompts and sandboxes only cover the commands the agent chooses to run, not the side effects of tools it calls for bookkeeping.
The practical takeaway is to decide what "opening a folder" is allowed to do, and to treat archives with a .git directory as untrusted input.
Try it yourself
Take one project archive you received from outside your team. Before opening it, run the grep above on its .git/config and list every hook, filter and helper it would run. Then see how a policy gate can stop risky changes before they reach a developer's IDE.
Click through it at your own pace, or open it full screen.
Quick check
Am I exposed if I only use git clone to fetch repositories?
The CVE records say an ordinary clone does not copy the source repository's local .git/config, so a plain clone alone is not enough for these attacks. The risk comes from archives or copied folders that include .git.
Does Codex's approval prompt protect against CVE-2026-19593?
No. The record says the program runs without a trust prompt, command approval or any model interaction, because Git launches it while Codex reads repository status.
Why does CVE-2026-19591 involve an MCP server?
The unapproved Git command could write to Codex's configuration. If Codex later loads that config, it can start an attacker-defined MCP server, which runs code as the user.
Sources
- NVD: CVE-2026-19590
- NVD: CVE-2026-19591
- NVD: CVE-2026-19592
- NVD: CVE-2026-19593
- Zero Day Initiative: ZDI-26-651
- openai/codex PR #22843: ignore configured hooks in git helpers
- openai/codex PR #22643: treat PowerShell stop-parsing forms as unsupported
- openai/codex PR #22652: ignore fsmonitor config in Git metadata reads
