CVE-2026-19590 in Codex Desktop
Summary
by MITRE • 09/01/2026
OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in OpenAI Codex Desktop represents a significant security flaw rooted in the improper handling of version control system configurations during automated operations. Specifically, the application trusts the local core.hooksPath setting within a Git repository without sufficient validation or sanitization. This trust model allows an attacker to craft a malicious repository where the .git/config file is configured to point core.hooksPath toward a directory controlled by the adversary. When a user opens such a repository using Codex Desktop, the application processes it and inadvertently triggers the execution of scripts located in that specified path. This behavior occurs because the software relies on standard Git mechanisms for hook management without implementing additional security checks to ensure that the hooks originate from trusted sources or adhere to safe execution policies.
The operational impact of this vulnerability is severe due to the context in which the malicious code executes. The attacker-controlled Git hooks run outside of Codex's command sandbox, effectively bypassing any isolation measures designed to limit the scope of actions performed by automated tools. Furthermore, these scripts execute without requiring explicit user approval and operate with the full privileges of the authenticated user account. This lack of restriction means that a malicious hook can perform arbitrary file operations on the local system, including reading sensitive data, modifying existing files, or deleting critical resources. It also grants access to other networked or peripheral resources available to the user's account, potentially leading to broader compromise beyond just the immediate workspace.
From a technical classification perspective, this issue aligns with CWE-94, which describes improper control of generation of code (code injection), as well as CWE-78, involving improper neutralization of special elements used in an OS command. The exploitation technique mirrors tactics found in the MITRE ATT&CK framework, particularly those related to execution via scheduled tasks or scripts that leverage legitimate system utilities for malicious purposes. It is important to note that this vulnerability requires specific conditions to be exploited; specifically, it relies on the preservation of repository-local configuration during certain operations. An ordinary Git clone typically does not preserve these attacker-controlled configurations by default, which limits the attack surface but does not eliminate the risk entirely if users employ alternative methods for importing or syncing repositories that retain such settings.
To mitigate this vulnerability, OpenAI should implement stricter validation mechanisms when processing Git repository metadata. This includes validating the core.hooksPath setting to ensure it points only to trusted directories within the application's own secure environment rather than arbitrary user-controlled paths. Additionally, enforcing a sandboxed execution context for all automated operations is critical to prevent privilege escalation and unauthorized access to local resources. Users should be advised to exercise caution when opening repositories from untrusted sources and to keep their software updated with any patches released by OpenAI that address this configuration trust issue. Regular audits of how third-party tools interact with version control systems can also help identify similar misconfigurations in other applications.