OpenAI Codex CLI and Desktop are vulnerable to local arbitrary code execution triggered by opening malicious Git repositories, potentially leading to a full compromise of the user account.

This vulnerability involves the improper handling of Git repository configurations, specifically the core.fsmonitor setting, which allows an attacker to execute arbitrary code with the privileges of the user running the application. The flaw is triggered when a user opens a repository containing a malicious configuration, bypassing standard user approval prompts.

Successful exploitation permits an attacker to execute arbitrary commands on the host system with the same permissions as the user running the Codex software. This poses a significant risk of data exfiltration, unauthorized modification of local files, and potential persistence on the workstation, justifying the high CVSS score of 7.3.

Immediate Action: Upgrade Codex CLI to version 0.131.0 or later, and update Codex Desktop to the respective fixed versions specified in the enrichment data (26.519.22136 for macOS, 26.519.21041 for Windows, or 26.519.2081.0 for the Microsoft Store package).

Proactive Monitoring: Monitor system logs for unexpected child processes spawned by Git or Codex-related binaries, particularly those originating from untrusted or external Git repository directories.

Compensating Controls: Avoid opening Git repositories from untrusted or unknown sources until the software has been updated to the patched versions.

Public Exploit Available: No confirmed public exploit (Metasploit or ExploitDB) is available at this time.

Given the potential for full user-level code execution, organizations should prioritize the immediate deployment of the patched versions of Codex CLI and Desktop. Users should be advised to exercise caution regarding the provenance of Git repositories they clone or open until these updates are fully applied across the environment.