External risk intelligence

OpenAI Codex Desktop Arbitrary Code Execution via Git Metadata

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-19593

This vulnerability is tied to the local execution of a desktop application when a user manually opens a specific, attacker-prepared local repository folder. It requires local file system interaction and cannot be exploited over the public internet or via a remote network service.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in OpenAI Codex Desktop could allow an attacker to run unauthorized programs with a user's privileges by tricking them into opening a specially crafted workspace. This could lead to unauthorized access, modification, or deletion of files and credentials. The risk is associated with opening malicious repositories, not through typical network-based attacks.

User opens a malicious repository.
Allows arbitrary code execution on user's machine.
Confirm if this impacts your organization.

Attack Path

How an attacker could exploit the issue

An attacker could create a malicious Git repository with a specially crafted `.git/config` file. When a user opens a workspace containing this repository in OpenAI Codex Desktop, the application will process the Git configuration, leading to the execution of an attacker-controlled program with the user's privileges. This bypasses security prompts, allowing the attacker to manipulate files and access user credentials.

Requires user to open a prepared repository.
Vulnerable Git configuration triggers program execution.
Risk of unauthorized file access and credential theft.

Live Threat

Current exploitation, exposure, and threat context

When a user opens a workspace with a specially crafted Git configuration, OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled programs with the user's privileges. This occurs because the `attr.tree` setting and configured filters can bypass security prompts.

User credentials and files on the local system.
Opening a malicious Git repository.
Unauthorized access and data manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in OpenAI Codex Desktop requires local user interaction to exploit, making it most relevant to individuals and teams managing developer workstations. The primary concern is the execution of arbitrary code with user privileges when opening a specially crafted Git repository. Therefore, the initial focus should be on identifying affected developer machines, assessing the risk based on user activity and the presence of such repositories, and then coordinating with development teams and potentially vendor management for remediation.

Developer workstation owners should investigate.
Verify Git configuration on workstations.
Plan for code execution risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenAI Codex Desktop?

OpenAI Codex Desktop is a software application for Windows and macOS used by developers to interact with code repositories. It includes features that automatically inspect Git metadata and the working-tree status of a workspace to provide assistance or context. The tool simplifies developer workflows by integrating directly with local file systems to track repository states.

What is the vulnerability in CVE-2026-19593?

This vulnerability is classified as CWE-15, which relates to external control of configuration settings. In this case, the application's automatic processing of a repository's .git/config file allows an attacker to define custom clean or process filters. Because the software fails to sandbox these commands or request user approval, it inadvertently executes arbitrary code with the full privileges of the person running the application.

How is this vulnerability triggered?

Exploitation requires a user to manually open a specific, attacker-prepared repository folder within the application where the malicious .git/config file remains intact. It is not triggered by a standard Git clone operation, as that process typically does not copy the sensitive local configuration. The attack does not activate if the user interacts with standard, legitimate repositories that lack these specific malicious settings.

Is my machine at risk if it is internet-facing?

According to Halo Surface Signal, this vulnerability is very unlikely to be exploited over the public internet or through a remote network service. The threat is tied to local execution, requiring a user to manually open a malicious folder on their system. Consequently, while internet-facing machines are generally exposed to different threats, the primary concern here is the local interaction with untrusted repository files on developer workstations.

How should I respond to this threat?

Focus your immediate efforts on identifying developer workstations where OpenAI Codex Desktop is installed. Evaluate your team's workflows to determine if they frequently handle repositories from untrusted sources. Since the exploit relies on the presence of a manipulated .git/config file, prioritize auditing local Git configurations and educating users about the security risks of opening workspaces from unknown or suspicious origins.

References

openai.com/codex

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.