CVE-2026-19591 in Codex CLI
Summary
by MITRE • 09/01/2026
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user's privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability in OpenAI Codex CLI for Windows, macOS, and Linux, as well as Codex Desktop for Windows and macOS, stems from a critical misclassification of PowerShell commands due to an incorrect interpretation of the stop-parsing token, denoted by --%. This security flaw arises because Codex’s internal command-safety parser does not align with how the native PowerShell engine processes this specific syntax. In standard PowerShell operations, the --% token signals that all subsequent arguments should be treated as literal strings rather than being evaluated for variable expansion or command execution logic. By failing to recognize this distinction correctly, Codex erroneously categorizes certain complex commands as safe, thereby bypassing its own safety mechanisms designed to prevent unauthorized system modifications.
When a user opens an attacker-prepared repository and instructs Codex to follow the provided instructions, the flawed parser allows the execution of file-writing Git commands without triggering the necessary user approval prompts. This lack of explicit consent is particularly dangerous because it enables automated actions that can alter critical files on the host system. On macOS and Linux platforms, successful exploitation additionally requires that PowerShell Core (pwsh) be separately installed and invoked by the application. If filesystem permissions allow for writes to specific directories, an attacker can modify Codex’s configuration files through this mechanism. This modification is not merely cosmetic; it serves as a vector for deeper compromise of the user's environment.
The operational impact of this vulnerability is severe, as modifying Codex's configuration allows an attacker to launch a malicious Model Context Protocol (MCP) server under the context of the currently logged-in user. Once this unauthorized MCP server is active, it can execute arbitrary code with the same privileges held by the victim account. This effectively grants the attacker full control over the accessible file system, enabling them to read sensitive data, alter existing files, or delete critical resources at will. The ability to escalate from a simple configuration change to remote code execution highlights the severity of bypassing user approval mechanisms in tools that interact with local systems and external services.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation, as the application fails to correctly validate the semantic meaning of PowerShell syntax before determining its safety profile. Furthermore, it relates to CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection), specifically regarding the mishandling of command-line arguments that alter parsing behavior. In terms of offensive security frameworks, this vulnerability facilitates techniques associated with ATT&CK T1059 Command and Scripting Interpreter, where attackers leverage system utilities to execute malicious payloads, and potentially ATT&CK T1204 User Execution if social engineering is used to get the user to open the prepared repository.
Mitigation strategies must focus on correcting the parsing logic within Codex’s safety layer to strictly adhere to PowerShell's native interpretation of special tokens like --%. Until a patch is deployed, users should exercise extreme caution when interacting with repositories from untrusted sources and avoid allowing automated tools to execute commands that involve file system modifications or configuration changes. Additionally, administrators can leverage existing filesystem sandboxing protections available on macOS and Linux, which by default prevent writes outside permitted locations, thereby limiting the scope of potential damage even if the approval bypass is triggered. Regular updates to Codex are essential to ensure these parsing discrepancies are resolved and user consent mechanisms remain robust against such evasion techniques.