CVE-2026-19593 OpenAI CVE debrief

Who should care

Defenders and administrators responsible for OpenAI Codex Desktop installations, especially in environments where Git is used, should assess exposure and prioritize mitigation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and mitigate this vulnerability.

Why it matters

Defenders should prioritize verifying and mitigating this vulnerability in OpenAI Codex Desktop for Windows and macOS, especially in environments where Git is used, as it allows an attacker to run an attacker-controlled program with the signed-in user's privileges.

• An attacker can read, modify, or delete files and access credentials available to that user.
• The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model.
• Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact.

Technical summary

OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in OpenAI Codex Desktop for Windows and macOS, especially in environments where Git is used.

Recommended defensive actions

• Verify OpenAI Codex Desktop versions and ensure they are up-to-date
• Restrict access to Git repositories and configure Git safely
• Monitor for suspicious activity and implement additional security measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in OpenAI Codex Desktop. The vulnerability requires Git to be available on PATH and a user to open an attacker-prepared repository with its local Git configuration intact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.