{"id":"CVE-2026-19593","title":"OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace","summary":"OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree …","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-15"],"vendor":"OpenAI","product":"Codex Desktop","affected":["codex_desktop >= 260202.0859 <= 26.513.31313","codex_desktop >= 26.304.38 <= 26.513.40821","codex_desktop_microsoft_store_package >= 26.304.38.0 <= 26.513.4821.0"],"published":"2026-09-01","updated":"2026-10-15","sourceUpdated":"2026-10-15T17:17:21.530","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19593","references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-651/","label":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-02T17:19:21.924083Z"},"epss":0.00366,"epssPercentile":0.28777,"zeroDay":true,"ingestedAt":"2026-10-15T17:18:20.025Z","slug":"CVE-2026-19593","body":"## Overview\n\nOpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"hadal","depthScore":79,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":25,"ransomware":0},"changes":[]}