CVE-2026-19590: OpenAI Codex Desktop arbitrary code execution via Git hooks

CVE-2026-19590 · Severity: high · CVSS 7.3 · Published 2026-09-01

OpenAI Codex Desktop for Windows and macOS is a development tool that performs automated Git operations on repositories. When a user opens a specially crafted repository, an attacker can execute malicious code by placing it in a Git hook that Codex runs without user approval. This code runs with the user's full privileges, potentially allowing an attacker to steal files, modify code, or compromise the developer's system.

Technologies: OpenAI Codex Desktop. Vendors: OpenAI.

Quick answers

Is CVE-2026-19590 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19590 being exploited in the wild.
How severe is CVE-2026-19590?
High severity, with a CVSS score of 7.3, published 1 September 2026.
Which products and versions are affected?
OpenAI Codex Desktop prior to 2026-05-15 patch.
Is there a fix for CVE-2026-19590?
A patch was published on 2026-05-15: Fix merged to ignore configured hooks in Git helpers (Pull Request #22843) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19590 attacked?
It is attacked with local access.
Am I affected by CVE-2026-19590?
Check whether you run OpenAI Codex Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a code execution flaw in Codex's Git integration layer. Codex automatically processes repositories and executes Git commands that respect the repository-local core.hooksPath configuration setting. An attacker can craft a .git/config file in a malicious repository pointing core.hooksPath to an attacker-controlled directory containing malicious Git hooks. When Codex performs automated Git operations on this repository, the hook executes outside Codex's command sandbox with the user's full privileges, without any user prompt or approval. The attack requires the user to open a specially prepared repository, but does not require the standard git clone operation to complete. The fix, merged on 2026-05-15, makes Codex's internal Git helper commands ignore configured hook directories by passing a command-local core.hooksPath override.

Affected products

  • OpenAI Codex Desktop prior to 2026-05-15 patch

Timeline

  • 2026-09-01: disclosed: CVE-2026-19590 published
  • 2026-05-15: patched: Fix merged to ignore configured hooks in Git helpers (Pull Request #22843)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.