CVE-2026-19592: CWE-15: External Control of System or Configuration Setting in OpenAI Codex CLI

OpenAI Codex CLI for Windows, macOS, and Linux, along with Codex Desktop for Windows and macOS, automatically collects Git repository metadata but does not disable the repository-local core.fsmonitor setting. If a user opens or uses a repository prepared by an attacker that preserves a .git/config file setting core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git will execute this helper during metadata collection. This execution happens outside the Codex command sandbox and without prompting the user, allowing arbitrary code execution with the user's privileges. The attacker-controlled code can read, modify, or delete user files and access other resources available to the user's account. Exploitation requires the repository to be delivered or copied with the malicious .git/config intact, as a standard Git clone does not preserve this local configuration.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Codex CLI or Desktop. This can lead to unauthorized reading, modification, or deletion of user files and access to other resources available to the user's account. The vulnerability has a CVSS score of 7.3 (high severity), indicating significant confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening or using repositories delivered or copied with preserved .git/config files containing untrusted core.fsmonitor settings. Ordinary Git clones do not preserve this configuration, so using standard cloning methods reduces risk. Monitor vendor communications for updates and official patches.