HighVulnerabilityLLM-specific

CVE-2026-19592: OpenAI Codex CLI and Desktop code execution via malicious repository Git config

Source: NVD(opens in a new tab)
Identifier: CVE-2026-19592
Published: September 1, 2026
Record updated: October 10, 2026

Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.2%

Summary

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.fsmonitor at an attacker-controlled filesystem-monitor helper, Git runs that helper outside Codex's command sandbox and without user approval, letting attacker code act with the user's privileges, including reading, changing, or deleting files. An ordinary Git clone does not preserve the local .git/config, so exploitation requires a repository delivered or copied with that configuration intact.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Details

Scores and exploitation

EPSS: 0.2%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 4, 2026.
Disclosure date: September 1, 2026

Weaknesses and techniques

Weakness (CWE): CWE-15

Affected

Vendors: OpenAI

Classification

Attack type: Other
Attack sophistication: Moderate
AI component targeted: Agent
Impact: Confidentiality,
Integrity,
Availability
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-19592

First tracked: September 1, 2026 at 08:08 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)

Coverage

News, research and other items that mention CVE-2026-19592.

Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker CodeThe Hacker News · 2026-09-02

Summary

Mitigation

Coverage

Related items