Codex Desktop's automatic Git inspection honoured a repository's attr.tree and filter configuration (CVE-2026-19593)
Codex Desktop for Windows and macOS automatically inspected Git metadata and working tree status when a workspace was opened, and a repository's own attr.tree setting, combined with a configured clean or process filter, could cause Git to run an attacker controlled program during that inspection. OpenAI's own CVE Numbering Authority published CVE-2026-19593 on 1 September 2026, naming a mechanism distinct from CVE-2026-19592's core.fsmonitor path in an overlapping but not identical Codex product surface.
Affected
- Organisation
- OpenAI
- Product
- Codex Desktop
- Component
- Automatic Git metadata and working tree inspection performed when a workspace is opened
- Versions
- unknown
- Configurations
- Repository's .git/config, together with a tracked or configured attr.tree setting, selects an executable clean or process filter
Execution authority facts
Fields the evidence does not establish are shown as unknown rather than guessed.
- Intended task
- Codex Desktop's own automatic inspection of Git metadata and working tree status when a workspace is opened
- Agent
- Codex Desktop's internal Git subprocess handling
- Delegating actor
- The signed in user opening the repository as a workspace in Codex Desktop
- Action
- Executed an attacker controlled program selected through a repository's attr.tree setting and a configured clean or process filter, outside Codex's own command sandbox and without a user approval prompt
- Target resource
- The host running Codex Desktop, with the signed in user's own privileges
- Environment
- A local developer workstation or desktop session running Codex Desktop against an untrusted repository
- Credentials used
- unknown
- Privileges available
- The signed in user's own account privileges, able to read, change or delete the user's files and reach credentials available to that account, per the CVE's own description
- Authority presented
- None; the action ran as automatic Git metadata and working tree inspection rather than a tool call the model or user approved
- Authority required
- Authorization for host code execution with the signed in user's own privileges, outside Codex's own command sandbox
- Applicable policy
- Codex's own command sandbox and tool approval model, which this action ran outside of
- Approval mechanism
- none
- Required approver
- unknown
- Independent approval
- no
- Action binding
- unknown
- Sequence context
- Ran during Codex Desktop's automatic Git metadata and working tree inspection when the workspace was opened, before any workspace trust prompt, command approval or model interaction, per the CVE's own description
Impact
- Consequence
- Attacker controlled code able to read, modify or delete the user's files and access credentials available to that user, per the CVE record's own description
- Reach
- single
- Reversibility
- unknown
- Detectability
- silent
- Propagation
- potential
- Recovery
- unknown
Evidence
Primary sources
- CVE-2026-19593 record, CVE Program (CVE Program)
Supporting sources
- CVE-2026-19593: CWE-15, External Control of System or Configuration Setting in OpenAI Codex Desktop (OffSeq Threat Radar)
- GitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, and Grok (Manifold Security)
- fix(tui): prevent repository-configured code execution in /diff (Pull Request 24954) (GitHub, openai/codex)
- Reproduction status
- CVE-2026-19593's own description is corroborated identically across multiple independent threat intelligence aggregators; not independently reproduced by Moona Intelligence against a running Codex Desktop instance, and OpenAI's own CVE record text could not be directly fetched in this session.
- Evidence state
- Confirmed
Known unknowns
- Whether OpenAI's own CNA assignment for this CVE originated from Manifold Security's GitSpawn report or from an independently filed finding, as was established directly for CVE-2026-19592.
- The affected and, if shipped, fixed Codex Desktop version numbers.
- Whether real world exploitation has occurred beyond the disclosure and reproduction described in available material.
Limitations
- CVE-2026-19593's own record at cve.org could not be directly fetched in this session and is corroborated through repeated, independently phrased search passes converging on an identical description across multiple threat intelligence aggregators.
- No first party OpenAI pull request, commit or release could be independently linked to this exact CVE. Pull request 24954, merged 28 May 2026, neutralises the same class of repository configured clean and process filter entries, but for Codex CLI's own diff command rather than Codex Desktop's automatic workspace inspection, and is preserved here only as adjacent evidence of the same mechanism elsewhere in Codex, not as this CVE's own remediation.
Claim provenance
- independent-reporting
CVE-2026-19593's own record could not be fetched directly in this session. Its description, CWE-15 classification and 1 September 2026 publication date are corroborated identically across multiple independent threat intelligence aggregators rather than read directly.
The Agent Ran Code Before It Asked Whether You Trusted the Repository - verified
Fetched directly. Confirms OpenAI is one of two organisations, with Anthropic, holding CVE Numbering Authority status under the CVE Program's Frontier AI Researcher CNA pilot, launched 28 July 2026 and scoped to vulnerabilities they discover in widely adopted products not already covered by another CNA, the basis for treating OpenAI as CVE-2026-19593's own assigning CNA.
The Agent Ran Code Before It Asked Whether You Trusted the Repository - verified
Fetched directly. This merged pull request neutralises repository configured filter.driver.clean and filter.driver.process entries, together with core.fsmonitor and core.hooksPath, but for Codex CLI's own diff command in its terminal interface, merged 28 May 2026 and closing an internal reference (PSEC-4395), rather than Codex Desktop's automatic workspace inspection that CVE-2026-19593 describes. It does not name attr.tree or CVE-2026-19593. Preserved as adjacent, not equivalent, evidence; this record does not treat it as CVE-2026-19593's own remediation.
The Agent Ran Code Before It Asked Whether You Trusted the Repository
Protocol evidence
Published authority architectures whose artifacts bear on the requirement this vulnerability exposes: which satisfy it, which expose a way past it, and which leave it unanswered.
- Supports requirement
Agent Action Decision Protocol (AADP)
Shamik Saha, individual submission to the IETF
Requirement A Policy Decision Point owns authorization state and evidence; PEPs enforce it
CVE-2026-19593 is a second, differently mechanised Codex Git execution path reaching the same gap AADP's Policy Decision Point and Policy Enforcement Point separation answers: a repository controlled attr.tree setting and configured clean or process filter ran an attacker controlled program with no applicable policy standing between Codex Desktop's automatic Git inspection and that execution. That a distinct extension mechanism reaches the same unmediated execution in the same vendor's own product line supports the requirement at the level of the class rather than one setting.