CVE-2026-19590: OpenAI Node Git hook trust flaw

CISO Take

OpenAI Codex Desktop for Windows and macOS will silently execute a Git hook defined in a repository's local core.hooksPath setting during routine automated Git operations, letting an attacker who gets a user to open a specially prepared repository run arbitrary code with the user's full privileges — outside Codex's command sandbox and without any approval prompt. This is a sandbox-bypass, local code execution vector in a widely deployed AI coding assistant; there is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, and OpenAI itself notes that an ordinary `git clone` does not preserve the malicious repository-local configuration required to trigger it, which narrows realistic delivery to zips, tarballs, shared folders, or CI artifacts rather than a normal clone workflow. Even with that narrower path, the payoff is severe: a full sandbox escape with arbitrary file read/write/delete and access to whatever the user's account can reach, which matters for any organization letting developers point Codex Desktop at externally sourced or forked code. A fix is referenced in openai/codex PR #22843 — confirm and apply an updated Codex Desktop build, and until then treat any repository not obtained via a fresh `git clone` as untrusted before opening it in Codex, checking `.git/config` for unexpected `core.hooksPath` entries.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Medium-severity local code execution with high impact but constrained exploitability. There is no assigned CVSS score, no EPSS percentile, no CISA KEV listing, and no public exploit or Nuclei template, and the vendor explicitly states a plain `git clone` does not carry the attacker-controlled configuration needed — exploitation requires the victim to acquire the repository through some other channel (archive extraction, shared drive, CI artifact, IDE 'open folder' on an unpacked copy) and then open it in Codex Desktop. That user-interaction and non-standard-delivery requirement lowers the likelihood of opportunistic mass exploitation, but the impact ceiling is high: full sandbox bypass and arbitrary code execution at the user's privilege level, with no approval gate. Treat as a targeted/social-engineering risk against developers rather than an internet-scannable one.

How does the attack unfold?

Malicious repo crafted

Attacker prepares a repository whose local .git/config sets core.hooksPath to a directory containing a malicious hook script.

AML.T0079

Delivery & user execution

Victim obtains the repo through a non-clone channel (zip, archive, shared drive) that preserves the malicious config, then opens it in Codex Desktop.

AML.T0011

Sandbox-bypassing execution

Codex performs a routine automated Git operation, triggering the malicious hook to run outside Codex's command sandbox without user approval.

AML.T0053

Impact — full user-level compromise

The hook executes with the user's OS privileges, enabling file theft, modification, deletion, or further lateral movement.

AML.T0112.000

Malicious repo crafted

Attacker prepares a repository whose local .git/config sets core.hooksPath to a directory containing a malicious hook script.

AML.T0079

Delivery & user execution

Victim obtains the repo through a non-clone channel (zip, archive, shared drive) that preserves the malicious config, then opens it in Codex Desktop.

AML.T0011

Sandbox-bypassing execution

Codex performs a routine automated Git operation, triggering the malicious hook to run outside Codex's command sandbox without user approval.

AML.T0053

Impact — full user-level compromise

The hook executes with the user's OS privileges, enabling file theft, modification, deletion, or further lateral movement.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenAI Node	npm	—	No patch
11.2K1.8K dependentsPushed today56% patched~139d to patchFull package profile →
OpenAI Node	npm	—	No patch
11.2K1.8K dependentsPushed today56% patched~139d to patchFull package profile →

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVLocal

ACLow

PRLow

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Track and apply the Codex Desktop update referencing openai/codex PR #22843 as soon as a patched build is confirmed available (no patched version number is published yet). 2) Until patched, only open repositories in Codex Desktop that were obtained via a direct git clone from a trusted remote — avoid opening extracted zips/tarballs, copies from shared drives, or CI-extracted artifacts. 3) Before opening an unfamiliar or externally sourced repository, inspect .git/config for an unexpected core.hooksPath entry pointing outside the standard .git/hooks directory. 4) As defense in depth, set git config --global core.hooksPath to a fixed, organization-controlled directory (or a known-empty one) so repository-local overrides are ignored globally. 5) Monitor endpoint telemetry for unexpected child processes spawned by Codex Desktop coinciding with Git operations, which would indicate hook execution.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainAgentAML.T0011- User Execution AML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.6-AI system security

NIST AI RMF

MEASURE-2.7-AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-19590?

OpenAI Codex Desktop for Windows and macOS will silently execute a Git hook defined in a repository's local core.hooksPath setting during routine automated Git operations, letting an attacker who gets a user to open a specially prepared repository run arbitrary code with the user's full privileges — outside Codex's command sandbox and without any approval prompt. This is a sandbox-bypass, local code execution vector in a widely deployed AI coding assistant; there is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, and OpenAI itself notes that an ordinary `git clone` does not preserve the malicious repository-local configuration required to trigger it, which narrows realistic delivery to zips, tarballs, shared folders, or CI artifacts rather than a normal clone workflow. Even with that narrower path, the payoff is severe: a full sandbox escape with arbitrary file read/write/delete and access to whatever the user's account can reach, which matters for any organization letting developers point Codex Desktop at externally sourced or forked code. A fix is referenced in openai/codex PR #22843 — confirm and apply an updated Codex Desktop build, and until then treat any repository not obtained via a fresh `git clone` as untrusted before opening it in Codex, checking `.git/config` for unexpected `core.hooksPath` entries.

Is CVE-2026-19590 actively exploited?

No confirmed active exploitation of CVE-2026-19590 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-19590?

1) Track and apply the Codex Desktop update referencing openai/codex PR #22843 as soon as a patched build is confirmed available (no patched version number is published yet). 2) Until patched, only open repositories in Codex Desktop that were obtained via a direct `git clone` from a trusted remote — avoid opening extracted zips/tarballs, copies from shared drives, or CI-extracted artifacts. 3) Before opening an unfamiliar or externally sourced repository, inspect `.git/config` for an unexpected `core.hooksPath` entry pointing outside the standard `.git/hooks` directory. 4) As defense in depth, set `git config --global core.hooksPath` to a fixed, organization-controlled directory (or a known-empty one) so repository-local overrides are ignored globally. 5) Monitor endpoint telemetry for unexpected child processes spawned by Codex Desktop coinciding with Git operations, which would indicate hook execution.

What systems are affected by CVE-2026-19590?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local AI coding agents, developer tooling / IDE integrations.

What is the CVSS score for CVE-2026-19590?

CVE-2026-19590 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.15%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal AI coding agentsdeveloper tooling / IDE integrations

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE-2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.

Exploitation Scenario

An attacker crafts a repository directory (not distributed via a normal `git clone`) whose `.git/config` sets `core.hooksPath` to a bundled `hooks/` folder containing a malicious script disguised as a `post-checkout` or `pre-commit` hook. The attacker packages this as a zip file — e.g., attached to a phishing email framed as 'review this feature branch' or shared as a code sample in a chat channel — and convinces a developer to extract it and open the folder in Codex Desktop. When Codex performs a routine automated Git operation (status check, diff, or commit) while working in that folder, the malicious hook fires outside Codex's command sandbox with no approval prompt, executing with the developer's OS privileges to exfiltrate SSH/cloud credentials, modify source code, or establish persistence on the workstation.

Weaknesses (CWE)

CWE-427Uncontrolled Search Path Element CWE-427Uncontrolled Search Path Element

CWE-427 — Uncontrolled Search Path Element: The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

[Architecture and Design, Implementation] Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
[Implementation] When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.

Source: MITRE CWE corpus.