# CVE-2026-19592: OpenAI Codex CLI and Desktop Git fsmonitor code execution

Source: https://junglewise.ai/threats/cve-2026-19592-openai-codex-cli-and-desktop-git-fsmonitor-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19592 · Severity: high · CVSS 7.3 · Published 2026-09-01

OpenAI Codex CLI and Desktop applications, used for code assistance and development, automatically collect Git repository metadata without properly disabling Git's fsmonitor setting. When opening an attacker-prepared repository with a malicious fsmonitor configuration in .git/config, Git can execute an attacker-controlled helper program outside Codex's sandbox without user approval. This allows an attacker to run arbitrary code with the user's privileges, potentially compromising files, credentials, and other resources on the user's system.

Technologies: [OpenAI Codex CLI](https://junglewise.ai/threats/technologies/codex-cli), [OpenAI Codex Desktop](https://junglewise.ai/threats/technologies/codex-desktop). Vendors: [OpenAI](https://junglewise.ai/threats/vendors/openai).

## Quick answers

**Is CVE-2026-19592 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19592 being exploited in the wild.

**How severe is CVE-2026-19592?** High severity, with a CVSS score of 7.3, published 1 September 2026.

**Which products and versions are affected?** OpenAI Codex CLI unspecified; OpenAI Codex Desktop unspecified.

**Is there a fix for CVE-2026-19592?** A patch was published on 2026-05-14: PR #22652 merged to ignore fsmonitor config in Git metadata reads Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19592 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-19592?** Check whether you run OpenAI Codex CLI or OpenAI Codex Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a code execution flaw in how Codex interacts with Git repositories. The root cause is that Codex's Git metadata collection subprocess does not disable the repository-local core.fsmonitor configuration setting, which allows Git to invoke a custom filesystem-monitor helper program. An attacker can craft a repository with a .git/config file containing a malicious core.fsmonitor value pointing to attacker-controlled code. When Codex opens or scans such a repository for metadata, Git spawns the helper outside Codex's command sandbox and without user approval, granting the attacker code execution at the user's privilege level. Exploitation requires delivery of the repository with the .git/config intact; normal Git clones do not preserve local configuration. A patch disables fsmonitor during Codex's Git metadata reads and adds regression tests.

## Affected products

- OpenAI Codex CLI unspecified
- OpenAI Codex Desktop unspecified

## Timeline

- 2026-09-01: disclosed: CVE-2026-19592 published
- 2026-05-14: patched: PR #22652 merged to ignore fsmonitor config in Git metadata reads

## References

- [https://github.com/openai/codex/pull/22652](https://github.com/openai/codex/pull/22652)

## Related threats

- [Codex Desktop for Windows code execution via unquoted path in file explorer](https://junglewise.ai/threats/cve-2026-110930-codex-desktop-for-windows-does-not-correctly-check-quotation)
- [OpenAI Codex Desktop arbitrary code execution via Git config](https://junglewise.ai/threats/cve-2026-19593-openai-codex-desktop-arbitrary-code-execution-via-git-config)
- [OpenAI Codex CLI and Desktop PowerShell command-safety bypass](https://junglewise.ai/threats/cve-2026-19591-openai-codex-cli-and-desktop-powershell-command-safety-bypass)
- [OpenAI Codex Desktop arbitrary code execution via Git hooks](https://junglewise.ai/threats/cve-2026-19590-openai-codex-desktop-arbitrary-code-execution-via-git-hooks)
- [OpenAI Codex CLI code execution via project-local configuration](https://junglewise.ai/threats/cve-2025-61260-openai-codex-cli-code-execution-via-project-local-configuration)