CVE-2026-19591: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences in OpenAI Codex CLI

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS improperly neutralize escape or control sequences in PowerShell commands because their command-safety parser interprets PowerShell's stop-parsing token (--%) differently than PowerShell itself. This misclassification allows Codex to execute a file-writing Git command without requesting user approval when opening an attacker-prepared repository. On macOS and Linux, exploitation additionally requires PowerShell Core (pwsh) to be installed. If filesystem permissions allow, the command can modify Codex's configuration file. When Codex loads this modified configuration, it can launch an attacker-controlled MCP server and execute arbitrary code with the user's privileges, enabling reading, modification, or deletion of files accessible to that user. The approval bypass does not disable filesystem sandboxing; the default sandbox on macOS and Linux can prevent writes outside permitted locations.

Successful exploitation allows an attacker to bypass user approval and execute file-writing Git commands, potentially modifying Codex's configuration. This can lead to arbitrary code execution with the privileges of the user running Codex, including reading, changing, or deleting files accessible to that user. The vulnerability affects confidentiality, integrity, and availability of the user's environment. On macOS and Linux, exploitation requires PowerShell Core and is limited by filesystem sandboxing, which may restrict the locations where files can be written.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when opening repositories from untrusted sources. On macOS and Linux, ensure that PowerShell Core is not installed if not needed, and verify filesystem sandboxing configurations to limit potential write locations. Monitor vendor communications for updates and apply official patches once released.