CVE-2026-19593: OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user open
Summary
OpenAI Codex Desktop for Windows and macOS automatically checked Git metadata (version control system files) when opening a workspace, which could allow an attacker to run malicious code if the repository contained a specially crafted .git/config file (Git's configuration file). This malicious code would run with the user's full permissions outside of Codex's security protections, potentially letting the attacker read, modify, or delete files and steal credentials.
Vulnerability Details
EPSS: 0.0%
September 1, 2026
Classification
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-19593
First tracked: September 1, 2026 at 08:08 PM
Classified by LLM (prompt v3) · confidence: 92%