CVE-2026-110930: Codex Desktop Windows: argument injection runs code

HIGH

Published November 5, 2026

CISO Take

Codex Desktop for Windows fails to validate quotation marks in project paths passed from Windows Explorer's "Open project in ChatGPT" action (CWE-88). A crafted path can inject startup arguments that run attacker-controlled code with the current user's permissions, before sign-in or project trust approval. This matters because it bypasses the product's own trust prompt, and developer workstations often hold source code, cloud credentials and API keys. There is no CISA KEV listing, no public exploit and no EPSS score yet, so the near-term likelihood is moderate. It does need user interaction, with the victim opening an attacker-supplied library item. The package has 1,762 downstream dependents and 29 other CVEs, which points to a broad footprint and a recurring flaw pattern. Update to the patched version in the OpenAI advisory (cve-2026-110930), and until then tell developers not to use the Explorer context-menu action on untrusted or shared folders.

Sources:NVDopenai.comATLAS

What is the risk?

High. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R, with high impact on confidentiality, integrity and availability. Exploitation needs the victim to select the context-menu action on an attacker-controlled library item, for example one delivered via a shared folder, a synced library or a downloaded archive. Code runs as the current Windows user before the trust dialog or sign-in, so the product's own safeguards do not apply. No public exploit, Nuclei template or KEV listing exists, and EPSS is unavailable. The attack is low-complexity once a malicious path is in place, and argument-injection flaws like this are quick to weaponize after disclosure. The vendor advisory is the only reference, so confidence in the details is MEDIUM.

How does the attack unfold?

Initial Access

The attacker places a crafted library item with a malicious path in a shared folder, sync or archive the victim will open.

AML.T0011.003

User Execution

The victim selects 'Open project in ChatGPT' in Explorer and the malformed quoted path is passed to Codex Desktop.

AML.T0011

Exploitation

Argument injection (CWE-88) adds startup arguments that execute attacker code before sign-in or project trust approval.

AML.T0112.000

Impact

Attacker code runs with the user's permissions, exposing source code, credentials and tokens for lateral movement or supply chain compromise.

AML.T0055

Initial Access

The attacker places a crafted library item with a malicious path in a shared folder, sync or archive the victim will open.

AML.T0011.003

User Execution

The victim selects 'Open project in ChatGPT' in Explorer and the malformed quoted path is passed to Codex Desktop.

AML.T0011

Exploitation

Argument injection (CWE-88) adds startup arguments that execute attacker code before sign-in or project trust approval.

AML.T0112.000

Impact

Attacker code runs with the user's permissions, exposing source code, credentials and tokens for lateral movement or supply chain compromise.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenAI Node	npm	—	No patch
11.2K1.8K dependentsPushed 5d ago53% patched~139d to patchFull package profile →
OpenAI Node	npm	—	No patch
11.2K1.8K dependentsPushed 5d ago53% patched~139d to patchFull package profile →

How severe is it?

CVSS 3.1

8.0 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Apply the fixed Codex Desktop for Windows release named in the OpenAI advisory (https://openai.com/security/advisories/cve-2026-110930/) for both the standard and Microsoft Store/MSIX builds. 2) Until patched, instruct developers not to use "Open project in ChatGPT" from Explorer on untrusted, shared or downloaded folders and libraries. 3) Where feasible, remove or disable the Explorer shell extension through endpoint management. 4) Detection: alert on Codex Desktop launching with unexpected command-line arguments, and on child processes such as cmd.exe, powershell.exe or unknown binaries spawned from the Codex process. 5) Restrict write access to shared libraries so untrusted users cannot plant crafted items. 6) Apply least privilege and application control (AppLocker or WDAC) on developer endpoints, and rotate credentials if exploitation is suspected.

How is it classified?

Code ExecutionSupply ChainAgentFrameworkAML.T0011- User Execution AML.T0050- Command and Scripting Interpreter AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-110930?

Is CVE-2026-110930 actively exploited?

No confirmed active exploitation of CVE-2026-110930 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110930?

1) Apply the fixed Codex Desktop for Windows release named in the OpenAI advisory (https://openai.com/security/advisories/cve-2026-110930/) for both the standard and Microsoft Store/MSIX builds. 2) Until patched, instruct developers not to use "Open project in ChatGPT" from Explorer on untrusted, shared or downloaded folders and libraries. 3) Where feasible, remove or disable the Explorer shell extension through endpoint management. 4) Detection: alert on Codex Desktop launching with unexpected command-line arguments, and on child processes such as cmd.exe, powershell.exe or unknown binaries spawned from the Codex process. 5) Restrict write access to shared libraries so untrusted users cannot plant crafted items. 6) Apply least privilege and application control (AppLocker or WDAC) on developer endpoints, and rotate credentials if exploitation is suspected.

What systems are affected by CVE-2026-110930?

This vulnerability affects the following AI/ML architecture patterns: AI coding assistants, Desktop agent clients, Developer workstations, Software supply chain / CI-CD.

What is the CVSS score for CVE-2026-110930?

CVE-2026-110930 has a CVSS v3.1 base score of 8.0 (HIGH).

What is the AI security impact?

Affected AI Architectures

AI coding assistantsDesktop agent clientsDeveloper workstationsSoftware supply chain / CI-CD

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.

Exploitation Scenario

An attacker shares a folder or Windows library with a developer, through a synced drive, a shared repository archive or a collaboration link. A child item has a name containing crafted quotation marks and extra arguments. The developer right-clicks it and picks "Open project in ChatGPT". The unescaped path splits into extra startup arguments, which Codex Desktop executes as attacker-controlled code under the developer's account before the sign-in or trust prompt appears. The attacker then harvests tokens, SSH keys and source code, and may pivot into CI/CD or cloud environments.

Weaknesses (CWE)

CWE-88Improper Neutralization of Argument Delimiters in a Command

CWE-88 — Improper Neutralization of Argument Delimiters in a Command: The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

[Implementation] Where possible, avoid building a single string that contains the command and its arguments. Some languages or frameworks have functions that support specifying independent arguments, e.g. as an array, which is used to automatically perform the appropriate quoting or escaping while building the command. For example, in PHP, escapeshellarg() can be used to escape a single argument to system(), or exec() can be called with an array of arguments. In C, code can often be refactored from using system() - which accepts a single string - to using exec(), which requires separate function arguments for each parameter.
[Architecture and Design] Understand all the potential areas where untrusted inputs can enter your product: parameters or arguments, cookies, anything read from the network, environment variables, request headers as well as content, URL components, e-mail, files, databases, and any external systems that provide data to the application. Perform input validation at well-defined interfaces.

Source: MITRE CWE corpus.