CVE-2026-19591: OpenAI Codex CLI and Desktop PowerShell command-safety bypass

CVE-2026-19591 · Severity: high · CVSS 8.8 · Published 2026-09-01

OpenAI Codex CLI and Desktop tools misclassify certain PowerShell commands as safe, allowing an attacker to trick the application into running unapproved Git commands that could modify Codex's configuration files. If the configuration is altered to load a malicious MCP server, the attacker can execute code with the user's privileges, potentially reading, modifying, or deleting files on the system. This vulnerability requires user interaction (opening an attacker-prepared repository) to trigger the exploit.

Technologies: OpenAI Codex CLI, OpenAI Codex Desktop. Vendors: OpenAI.

Quick answers

Is CVE-2026-19591 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19591 being exploited in the wild.
How severe is CVE-2026-19591?
High severity, with a CVSS score of 8.8, published 1 September 2026.
Which products and versions are affected?
OpenAI Codex CLI unspecified; OpenAI Codex Desktop unspecified.
Is there a fix for CVE-2026-19591?
A patch was published on 2026-05-14: Fix merged to treat PowerShell stop-parsing forms as unsupported Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19591 attacked?
It is attacked over the network or with local access.
Am I affected by CVE-2026-19591?
Check whether you run OpenAI Codex CLI or OpenAI Codex Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a command-safety parser bypass in OpenAI Codex CLI and Desktop that affects PowerShell command interpretation. The root cause is that Codex's parser interprets PowerShell's stop-parsing token (--%) differently than PowerShell itself, causing certain commands to be incorrectly classified as safe. An attacker can craft a repository that, when opened by a user, tricks Codex into executing a file-writing Git command without approval. On Windows, this alone allows configuration modification; on macOS and Linux, it additionally requires PowerShell Core (pwsh) to be separately installed. Once the configuration is modified, subsequent Codex invocations can load a malicious MCP server and achieve arbitrary code execution. The default filesystem sandbox on macOS and Linux provides some mitigation by restricting write locations. A fix was merged on May 14, 2026 that treats PowerShell stop-parsing forms as unsupported in the AST-backed command flattener.

Affected products

  • OpenAI Codex CLI unspecified
  • OpenAI Codex Desktop unspecified

Timeline

  • 2026-09-01: disclosed: CVE-2026-19591 published
  • 2026-05-14: patched: Fix merged to treat PowerShell stop-parsing forms as unsupported

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.