Intelligence
Join the waitlist
AEV-2026-0017

Codex CLI's own Git metadata reads honoured a repository's core.fsmonitor before a fix shipped (CVE-2026-19592)

Codex CLI and Codex Desktop collected Git repository metadata without disabling a repository's own core.fsmonitor setting, letting an attacker named helper run with the user's privileges outside Codex's own command sandbox. OpenAI's own merged fixes predate the September 2026 CVE by months; Manifold Security's later report of the same class was closed as a duplicate of the earlier, independently filed finding.

AESS 7.4 highConfirmedStatus: resolvedEvent: 1 September 2026Execution AuthorityEnvironment Boundaries

Affected

Organisation
OpenAI
Product
Codex CLI and Codex Desktop
Component
Automatic Git repository metadata collection (Git status and diff subprocesses)
Versions
Codex CLI for Windows, macOS and Linux and Codex Desktop for Windows and macOS, before the fixes merged in pull requests 22652 and 26880; CVE-2026-19592 published 1 September 2026
Configurations
Repository's .git/config sets an executable core.fsmonitor helper

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task
Codex's own automatic collection of Git repository metadata for context
Agent
Codex CLI and Codex Desktop's internal Git subprocess handling
Delegating actor
The developer opening or using the repository with Codex
Action
Executed a repository named core.fsmonitor helper outside Codex's own command sandbox and without a user approval prompt
Target resource
The host running Codex, with the user's own privileges
Environment
A local developer workstation or desktop session running Codex CLI or Codex Desktop against an untrusted repository
Credentials used
unknown
Privileges available
The user's own account privileges, able to read, change or delete the user's files and reach other resources available to that account
Authority presented
None; the action ran as internal Git metadata collection rather than a tool call the model or user approved
Authority required
Authorization for host code execution with the user's own privileges, outside Codex's own command sandbox
Applicable policy
Codex's own command sandbox and tool approval model, which this action ran outside of
Approval mechanism
none
Required approver
unknown
Independent approval
no
Action binding
unknown
Sequence context
Ran during Codex's own automatic Git metadata collection, before any model directed tool call

Impact

Consequence
Attacker controlled code able to read, change or delete the user's files and reach other resources available to the user's account, per the CVE record's own description
Reach
single
Reversibility
unknown
Detectability
silent
Propagation
potential
Recovery
unknown

Evidence

Primary sources

Supporting sources

Reproduction status
OpenAI's own merged pull requests and their regression handling verified directly; not independently reproduced by Moona Intelligence against a running Codex instance.
Evidence state
Confirmed

Known unknowns

  • The exact Codex CLI and Desktop version numbers CVE-2026-19592's own record considers affected and fixed.
  • Whether Manifold's own report, closed as a duplicate, targeted exactly the mechanism these two pull requests close or a further variant.

Limitations

  • CVE-2026-19592's own record at cve.org could not be directly fetched in this session and is corroborated through search. The two OpenAI pull requests cited as primary evidence were fetched directly and are the strongest basis for this entry's mechanism and timeline.

Claim provenance

  • verified
    OpenAI's own merged pull request, read directly, stops Codex's internal Git metadata and status subprocesses from honouring a repository's own core.fsmonitor setting, merged 14 May 2026 and referencing an internal identifier (ZDI_31270) consistent with a report through the Zero Day Initiative predating Manifold's own disclosure.
    The Agent Ran Code Before It Asked Whether You Trusted the Repository
  • verified
    OpenAI's own merged follow up pull request, read directly, preserves Git's built in file system monitor daemon only when it can be verified and otherwise disables core.fsmonitor, merged 9 June 2026 to close a performance regression the first fix introduced while still keeping a repository from selecting an executable helper of its own.
    The Agent Ran Code Before It Asked Whether You Trusted the Repository
  • verified
    GitHub's own advisory for CVE-2026-19592, read directly, confirms CWE-15 and a CVSS 3.1 base score of 7.3, states the helper runs outside Codex's own command sandbox and without a user approval prompt, and names pull request openai/codex#22652 as its reference, corroborating this entry's existing primary evidence rather than adding a new claim.
    The Agent Ran Code Before It Asked Whether You Trusted the Repository