Executive brief
OpenAI Codex Desktop for Windows and macOS is a development tool that performs automated Git operations on repositories. When a user opens a specially crafted repository, an attacker can execute malicious code by placing it in a Git hook that Codex runs without user approval. This code runs with the user's full privileges, potentially allowing an attacker to steal files, modify code, or compromise the developer's system.
Technical details
The vulnerability is a code execution flaw in Codex's Git integration layer. Codex automatically processes repositories and executes Git commands that respect the repository-local core.hooksPath configuration setting. An attacker can craft a .git/config file in a malicious repository pointing core.hooksPath to an attacker-controlled directory containing malicious Git hooks. When Codex performs automated Git operations on this repository, the hook executes outside Codex's command sandbox with the user's full privileges, without any user prompt or approval. The attack requires the user to open a specially prepared repository, but does not require the standard git clone operation to complete. The fix, merged on 2026-05-15, makes Codex's internal Git helper commands ignore configured hook directories by passing a command-local core.hooksPath override.
Affected products
- OpenAI Codex Desktop prior to 2026-05-15 patch
Timeline
- 2026-09-01: disclosed: CVE-2026-19590 published
- 2026-05-15: patched: Fix merged to ignore configured hooks in Git helpers (Pull Request #22843)