CVE-2026-19592: OpenAI Codex CLI and Desktop Git fsmonitor code execution

CVE-2026-19592 · Severity: high · CVSS 7.3 · Published 2026-09-01

OpenAI Codex CLI and Desktop applications, used for code assistance and development, automatically collect Git repository metadata without properly disabling Git's fsmonitor setting. When opening an attacker-prepared repository with a malicious fsmonitor configuration in .git/config, Git can execute an attacker-controlled helper program outside Codex's sandbox without user approval. This allows an attacker to run arbitrary code with the user's privileges, potentially compromising files, credentials, and other resources on the user's system.

Technologies: OpenAI Codex CLI, OpenAI Codex Desktop. Vendors: OpenAI.

Quick answers

Is CVE-2026-19592 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19592 being exploited in the wild.
How severe is CVE-2026-19592?
High severity, with a CVSS score of 7.3, published 1 September 2026.
Which products and versions are affected?
OpenAI Codex CLI unspecified; OpenAI Codex Desktop unspecified.
Is there a fix for CVE-2026-19592?
A patch was published on 2026-05-14: PR #22652 merged to ignore fsmonitor config in Git metadata reads Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19592 attacked?
It is attacked with local access.
Am I affected by CVE-2026-19592?
Check whether you run OpenAI Codex CLI or OpenAI Codex Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a code execution flaw in how Codex interacts with Git repositories. The root cause is that Codex's Git metadata collection subprocess does not disable the repository-local core.fsmonitor configuration setting, which allows Git to invoke a custom filesystem-monitor helper program. An attacker can craft a repository with a .git/config file containing a malicious core.fsmonitor value pointing to attacker-controlled code. When Codex opens or scans such a repository for metadata, Git spawns the helper outside Codex's command sandbox and without user approval, granting the attacker code execution at the user's privilege level. Exploitation requires delivery of the repository with the .git/config intact; normal Git clones do not preserve local configuration. A patch disables fsmonitor during Codex's Git metadata reads and adds regression tests.

Affected products

  • OpenAI Codex CLI unspecified
  • OpenAI Codex Desktop unspecified

Timeline

  • 2026-09-01: disclosed: CVE-2026-19592 published
  • 2026-05-14: patched: PR #22652 merged to ignore fsmonitor config in Git metadata reads

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.