{"data":{"id":"f3f2d19b-567a-487e-b9b4-c6c4f079eb1d","title":"ZDI-26-968: (Pwn2Own) OpenAI Codex GUI OpenProjectInCodex Argument Injection Remote Code Execution Vulnerability","summary":"ZDI-26-968 describes an argument injection flaw in the OpenProjectInCodex context menu command of OpenAI Codex, which allows remote attackers to execute arbitrary code as the current user. The issue stems from missing validation of a user-supplied string before it is used to build command-line arguments. Exploitation requires the target to open a malicious file, and the ZDI rates it CVSS 7.8, tracked as CVE-2026-110930.","solution":"OpenAI has issued an update to correct this vulnerability. More details are at https://openai.com/security/advisories/cve-2026-110930/","labels":["security"],"sourceUrl":"http://www.zerodayinitiative.com/advisories/ZDI-26-968/","publishedAt":"2026-11-13T06:00:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["OpenAI Codex"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-13T06:00:00.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":null,"fixes":[]}}