OpenAI Codex: four CVEs for git hooks, fsmonitor, PowerShell parsing, and Desktop git filters

Vulnerability · OpenAI Codex (CLI and Desktop) · HIGH

Incident dateNot stated

DisclosedSep 1, 2026 (OpenAI CVE records). ZDI-26-651 for CVE-2026-19593 published Sep 10, 2026; CVE record updated Oct 15, 2026. Fixes merged May 14–15, 2026 (PRs #22643, #22652, #22843). Added here as a backfill on Oct 15, 2026.

Added hereOct 15, 9:30 PM ET

Last verifiedOct 15, 2026

Summary

OpenAI published four CVE records on Sep 1, 2026 for Codex CLI and Codex Desktop. Three cover how automated Git work trusted a repository's own .git/config: CVE-2026-19590 (Desktop) ran hooks via core.hooksPath; CVE-2026-19592 (CLI and Desktop) ran a core.fsmonitor helper while gathering repo metadata; CVE-2026-19593 (Desktop) could run a clean or process filter when opening a workspace, including through attr.tree. CVE-2026-19591 is separate: the command-safety parser treated PowerShell's stop-parsing token (--%) as safe when PowerShell itself does not. Opening an attacker-prepared folder that still has its local .git/config (a zip, shared drive or similar—not an ordinary clone) is enough for the Git issues; no model prompt is required. OpenAI lists fixed Desktop builds 26.519.22136 (macOS), 26.519.21041 (Windows) and 26.519.2081.0 (Microsoft Store), and Codex CLI 0.131.0 for the CLI-affected CVEs. Trend Micro's Zero Day Initiative published ZDI-26-651 for CVE-2026-19593 on Sep 10, 2026; the CVE record added that reference on Oct 15, 2026. This is a backfill of already-fixed issues. It overlaps the GitSpawn class we covered for other agents, but these are OpenAI's own CVE records for Codex.

Severity

HIGH High (VibeIncidents editorial rating). CISA-ADP secondary scores on NVD are 7.3 High (19590, 19592), 8.8 High (19591) and 9.8 Critical (19593). ZDI rates CVE-2026-19593 CVSS 3.1 7.8 High with user interaction required (open a malicious folder), which matches OpenAI's description better than the 9.8 network/no-UI vector. The Git issues need a preserved local .git/config; a normal clone is not enough. Fixed in May–September 2026 builds. No exploitation reported.

Timeline

May 14, 2026
OpenAI merges Codex pull requests #22643 (PowerShell stop-parsing safety) and #22652 (ignore core.fsmonitor on Git metadata reads).
May 15, 2026
OpenAI merges pull request #22843 (ignore configured hooksPath in Git helpers).
Sep 1, 2026
OpenAI publishes CVE-2026-19590, CVE-2026-19591, CVE-2026-19592 and CVE-2026-19593 (OpenAI as CNA).
Sep 10, 2026
Trend Micro ZDI publishes ZDI-26-651 for CVE-2026-19593 (CVSS 7.8), crediting Ikotas Labs (Satoki Tsuji).
Oct 15, 2026
CVE-2026-19593 record updated; NVD last-modified time shows the ZDI reference on the NVD page.

How it happened

CVE-2026-19590: Desktop Git helpers trusted the workspace's core.hooksPath, so a preserved .git/config could point hooks at attacker scripts that ran during automated Git bookkeeping. Fixed by overriding hooksPath for those helpers (PR #22843). CVE-2026-19592: CLI and Desktop collected Git metadata without clearing core.fsmonitor, so a malicious fsmonitor command in .git/config ran outside the sandbox (PR #22652). CVE-2026-19593: Desktop inspected Git status on workspace open; with attr.tree and a clean/process filter in a preserved .git/config, Git ran attacker code with the signed-in user's privileges and without a trust or approval prompt. CVE-2026-19591: the safety parser lowered PowerShell stop-parsing forms (--%) into a shape it treated as safe, while PowerShell still executed the trailing command; Compass Security reported it; PR #22643 treats those forms as unsupported. OpenAI credits Sina Kheirkhah (Summoning Team) for 19590; Compass Security for 19591; Fudan University SSS Lab plus maitai/Doyensec via ZDI for 19592; Satoki Tsuji / Ikotas Labs for 19593.

How to check your app

Update Codex Desktop to 26.519.22136 or later on macOS, 26.519.21041 or later on Windows (direct install), or 26.519.2081.0 or later from the Microsoft Store.
Update Codex CLI to 0.131.0 or later (current releases are well past that; npm/cargo latest was past 0.162 as of mid-October 2026).
Do not open zip files, synced folders or USB copies of repositories as workspaces unless you trust how their .git/config was created; a normal git clone does not carry the source .git/config.
Related reading: our GitSpawn entry covers the same fsmonitor class across several other coding agents.

Sources

Corrections and updates

None. Re-checked against every source on Oct 15, 2026.