OpenAI Codex: RCE via .git/config, Patch Available

OpenAI has released a fix for a remote code execution vulnerability in its AI-assisted IDE, Codex Desktop. The flaw, tracked as CVE-2026-19593 and ZDI-26-651, was discovered during the Pwn2Own event. A modified .git/config file can bypass Codex's command sandbox, executing arbitrary programs with the user's privileges without a workspace-trust prompt or command approval. Coordinated disclosure occurred on September 10, 2026, roughly one hundred days after vendor notification.

How the Chain Works: From Innocuous Folder to RCE

The issue stems from the failure to sanitize Git configurations. When Codex Desktop opens a workspace folder, it automatically inspects the Git repository present. An altered .git/config can set attr.tree with a filter clean or process pointing to an attacker-controlled program. Git, invoked by the AI tool, executes that program.

According to the CVE-2026-19593 record, "the program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model." Codex's command sandbox is bypassed not due to a direct flaw in its isolation, but through a delegation chain: Codex invokes Git, which executes arbitrary code as configured by the attacker.

This pattern exploits legitimate Git behavior. Codex's failure to sanitize Git configurations turns opening a folder into a compromise vector.

Timeline and Scope: What the Official Record Covers

The vulnerability was reported to OpenAI on June 2, 2026, by Satoki Tsuji, a researcher at Ikotas Labs, Inc., with handle @satoki00. Coordinated disclosure followed the standard Zero Day Initiative process.

The ZDI-26-651 advisory confirms that "OpenAI has issued an update to correct this vulnerability." The CVE record lists three affected version ranges: 260202.0859 to 26.513.31313, 26.304.38 to 26.513.40821, and variants with a .0 suffix. The non-standard versioning format requires care in identifying exposed installations.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenAI Codex. User interaction is required to exploit this vulnerability in that the target must open a malicious folder." — Advisory ZDI-26-651

The Technical Mechanism in Detail

Git configuration offers multiple automatic execution points. Clean and process filters are designed to transform file content between the working tree and the index. When configured in .git/config, these filters point to arbitrary system executables.

The attacker prepares a folder that appears to be a normal Git repository. Inside, the .git/config file contains a [filter] section with a custom name. The attr.tree directive associates file extensions with this filter. When Codex Desktop opens the folder and Git processes attributes, the filter triggers.

The CVE record specifies that the program "runs outside Codex's command sandbox." This detail is critical: the sandbox exists, but does not protect against calls to uncontrolled external processes. The user sees no approval prompt because execution occurs in the context of Git, not in the context of AI-generated commands.

Known Source Limitations

The convergent primary sources — ZDI and CVE — present documented limitations. The CVSS score and vector are not specified in the ZDI advisory. The affected version format in the CVE record is anomalous and requires parsing verification. It is unclear whether the corrective update is distributed automatically or requires manual user action. The dossier does not document whether the exploit was demonstrated live during Pwn2Own or only classified as a discovery within the event scope.

Analysis: Git Delegation as Attack Surface

Git configuration is powerful: clean filters, smudge filters, merge drivers, diff drivers, and other hooks can execute code in response to seemingly passive operations. A tool that embeds Git without isolating these mechanisms inherits their attack surface.

The Codex case shows how the trust boundary between file inspection and code execution can be nullified when a secondary tool inherits implicit privileges. Codex's command sandbox remains intact within its scope; the bypass occurs via delegation, not by breaking isolation.

This architecture is common in modern IDEs. VS Code, JetBrains, and other integrated development environments integrate Git natively. Each of these tools inherits the same attack surface if it does not implement specific controls for untrusted repositories.

What to Do Now

• Verify the installed Codex Desktop version against the CVE ranges, paying attention to the non-standard version format
• Apply the corrective update released by OpenAI; manually verify the procedure completes successfully, as sources do not specify whether the update is automatic
• Do not open folders from Git repositories of unknown origin: opening the folder is the attack trigger

The lesson of CVE-2026-19593 lies in the distinction between containing code and controlling the execution chain. Codex had a sandbox for its own commands, but did not anticipate that Git — its trusted satellite — could be weaponized from the outside. For developers working with multiple repositories, the "open folder" vector is a daily occurrence and now a documented risk.

Information verified against cited sources and current as of publication.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-651/
• https://www.cve.org/CVERecord?id=CVE-2026-19593
• http://www.zerodayinitiative.com/advisories/upcoming/
• https://www.trendmicro.com/
• https://www.trendmicro.com/en_us/business/products/one-platform.html