CVE-2026-19593: CWE-15: External Control of System or Configuration Setting in OpenAI Codex Desktop

OpenAI Codex Desktop automatically inspects Git metadata and working-tree status upon workspace opening. If the workspace contains a repository with an attacker-controlled .git/config file that sets the attr.tree setting and configures a clean or process filter, Git will execute an attacker-controlled program. This program runs outside Codex's command sandbox with the privileges of the signed-in user, without any workspace-trust prompt, command approval, or interaction with the AI model. The attacker can thereby read, modify, or delete files and access credentials available to that user. Successful exploitation requires Git to be available on the system PATH and the user to open the attacker-prepared repository with its local Git configuration intact. A normal Git clone does not copy the source repository's .git/config file, so it alone does not enable exploitation.

The vulnerability allows an attacker to execute arbitrary code with the privileges of the signed-in user without any user interaction or approval. This can lead to full compromise of the user's files and credentials accessible to that user. The attack bypasses Codex's command sandbox and trust mechanisms, resulting in high confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening workspaces containing repositories with untrusted or attacker-controlled .git/config files. Ensure Git is not exposed on the system PATH in environments where untrusted repositories might be opened. Monitor vendor channels for official patches or updates addressing this vulnerability.