Executive brief
OpenAI Codex CLI and Desktop applications, used for code assistance and development, automatically collect Git repository metadata without properly disabling Git's fsmonitor setting. When opening an attacker-prepared repository with a malicious fsmonitor configuration in .git/config, Git can execute an attacker-controlled helper program outside Codex's sandbox without user approval. This allows an attacker to run arbitrary code with the user's privileges, potentially compromising files, credentials, and other resources on the user's system.
Technical details
This vulnerability is a code execution flaw in how Codex interacts with Git repositories. The root cause is that Codex's Git metadata collection subprocess does not disable the repository-local core.fsmonitor configuration setting, which allows Git to invoke a custom filesystem-monitor helper program. An attacker can craft a repository with a .git/config file containing a malicious core.fsmonitor value pointing to attacker-controlled code. When Codex opens or scans such a repository for metadata, Git spawns the helper outside Codex's command sandbox and without user approval, granting the attacker code execution at the user's privilege level. Exploitation requires delivery of the repository with the .git/config intact; normal Git clones do not preserve local configuration. A patch disables fsmonitor during Codex's Git metadata reads and adds regression tests.
Affected products
- OpenAI Codex CLI unspecified
- OpenAI Codex Desktop unspecified
Timeline
- 2026-09-01: disclosed: CVE-2026-19592 published
- 2026-05-14: patched: PR #22652 merged to ignore fsmonitor config in Git metadata reads