CVE-2026-19590: OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations

OpenAI Codex Desktop for Windows and macOS has a vulnerability where it automatically runs Git hooks (scripts that execute during Git operations) from a repository's local settings without checking if they're malicious. An attacker can create a specially prepared repository that, when opened in Codex, runs their malicious hook with the user's full permissions, potentially allowing them to steal, modify, or delete files.