Executive brief
OpenAI Codex CLI and Desktop tools misclassify certain PowerShell commands as safe, allowing an attacker to trick the application into running unapproved Git commands that could modify Codex's configuration files. If the configuration is altered to load a malicious MCP server, the attacker can execute code with the user's privileges, potentially reading, modifying, or deleting files on the system. This vulnerability requires user interaction (opening an attacker-prepared repository) to trigger the exploit.
Technical details
The vulnerability is a command-safety parser bypass in OpenAI Codex CLI and Desktop that affects PowerShell command interpretation. The root cause is that Codex's parser interprets PowerShell's stop-parsing token (--%) differently than PowerShell itself, causing certain commands to be incorrectly classified as safe. An attacker can craft a repository that, when opened by a user, tricks Codex into executing a file-writing Git command without approval. On Windows, this alone allows configuration modification; on macOS and Linux, it additionally requires PowerShell Core (pwsh) to be separately installed. Once the configuration is modified, subsequent Codex invocations can load a malicious MCP server and achieve arbitrary code execution. The default filesystem sandbox on macOS and Linux provides some mitigation by restricting write locations. A fix was merged on May 14, 2026 that treats PowerShell stop-parsing forms as unsupported in the AST-backed command flattener.
Affected products
- OpenAI Codex CLI unspecified
- OpenAI Codex Desktop unspecified
Timeline
- 2026-09-01: disclosed: CVE-2026-19591 published
- 2026-05-14: patched: Fix merged to treat PowerShell stop-parsing forms as unsupported