A critical vulnerability in OpenAI Codex Desktop allows unauthenticated attackers to execute arbitrary code with the privileges of the signed-in user by tricking them into opening a malicious repository.

This flaw involves the improper handling of Git configuration files, specifically the attr.tree setting and clean or process filters, which allows an attacker to execute code outside the application sandbox. The vulnerability is unauthenticated and requires no user interaction beyond opening a repository that contains an attacker-controlled .git/config file.

Successful exploitation results in full remote code execution, enabling an attacker to read, modify, or delete sensitive files and harvest credentials stored on the host system. With a CVSS score of 9.8, this vulnerability represents a critical risk to organizational data integrity and system security, as it bypasses standard workspace security prompts and operates with the full permissions of the user account.

Immediate Action: Update Codex Desktop for macOS to version 26.519.22136 or later, or Codex Desktop for Windows to version 26.519.21041 (Microsoft Store package 26.519.2081.0) or later.

Proactive Monitoring: Review endpoint process logs for unusual child processes spawned by Codex Desktop or Git operations within development workspaces.

Compensating Controls: Ensure that developers are aware of the risks associated with opening untrusted Git repositories and avoid cloning or opening repositories from unknown or unverified sources until the software has been patched.

Public Exploit Available: No (exploit_available: false)

Given the critical severity of this vulnerability and the potential for full system compromise, organizations should prioritize the immediate deployment of the patched versions of OpenAI Codex Desktop across all developer environments. Delaying this update exposes local developer workstations and the sensitive credentials they often contain to significant risk.