CVE-2026-19593: OpenAI Node Git config filter

CISO Take

OpenAI Codex Desktop automatically inspects Git metadata when a workspace is opened, and a preserved malicious .git/config can abuse Git's attr.tree setting alongside a configured clean or process filter to run an attacker-controlled program the moment the folder is opened — no model interaction, workspace-trust prompt, or command approval required. That program executes outside Codex's command sandbox with the full privileges of the signed-in developer, giving the attacker the ability to read, modify, or delete files and harvest any credentials available to that session. There is no CVSS score, EPSS data, CISA KEV listing, or public exploit yet, but the underlying mechanic is a well-documented Git attack class, and the delivery vector — a shared or downloaded repository with its .git/config intact, distinct from a plain `git clone` — is trivial to construct against developers who use Codex Desktop on Windows or macOS. Until OpenAI ships a patched build, treat any repository from outside your organization as untrusted before opening it in Codex Desktop: inspect .git/config for filter/clean/process directives first, open unknown repos in an isolated VM or without Git on PATH, and alert on unexpected child processes spawned by git under the Codex Desktop process tree.

Sources:NVDATLAS

What is the risk?

Exploitability is moderate at delivery (the attacker must get a victim to open a folder that still contains a rigged .git/config — not merely clone a repo — so some social engineering or file-sharing vector is required) but trivial and fully automatic once that folder is opened: no phishing click, no approval dialog, no AI model interaction needed, just opening the workspace. Impact is high — arbitrary code execution with the signed-in user's full privileges, entirely outside Codex's intended command sandbox, enabling file read/modify/delete and credential theft. Exposure is broad: any Codex Desktop user on Windows or macOS who opens external, vendor, or third-party repositories (a routine developer workflow) is at risk, and the absence of a CVSS score, EPSS data, or patched version today means defenders currently have no automated signal to act on — this has to be handled as a process control, not a patch, for now.

How does the attack unfold?

Initial Access

Attacker delivers a repository folder (zip, network share, or similar) that preserves a full, attacker-controlled .git/config — not a plain clone — and the victim opens it directly in Codex Desktop.

AML.T0011

Automatic Execution

Codex Desktop auto-inspects Git metadata/working-tree status on workspace open, causing Git to evaluate the attr.tree setting and invoke the configured malicious clean/process filter.

AML.T0050

Sandbox Escape / Privilege Abuse

The attacker's program runs outside Codex's command sandbox with the signed-in user's full privileges, with no workspace-trust prompt or approval required.

AML.T0106

Impact

Attacker reads, modifies, or deletes files and harvests credentials (SSH keys, cloud/API tokens) available to the compromised user session.

AML.T0055

Initial Access

Attacker delivers a repository folder (zip, network share, or similar) that preserves a full, attacker-controlled .git/config — not a plain clone — and the victim opens it directly in Codex Desktop.

AML.T0011

Automatic Execution

Codex Desktop auto-inspects Git metadata/working-tree status on workspace open, causing Git to evaluate the attr.tree setting and invoke the configured malicious clean/process filter.

AML.T0050

Sandbox Escape / Privilege Abuse

The attacker's program runs outside Codex's command sandbox with the signed-in user's full privileges, with no workspace-trust prompt or approval required.

AML.T0106

Impact

Attacker reads, modifies, or deletes files and harvests credentials (SSH keys, cloud/API tokens) available to the compromised user session.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenAI Node	npm	—	No patch
11.2K1.8K dependentsPushed today56% patched~139d to patchFull package profile →
OpenAI Node	npm	—	No patch
11.2K1.8K dependentsPushed today56% patched~139d to patchFull package profile →

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

No patched version is published yet (affected products show no fixed version for either the npm or Microsoft Store builds), so mitigation is procedural: (1) do not open repositories obtained as raw folders/zips/network shares (which can carry a live .git/config) in Codex Desktop unless their origin is fully trusted — a normal git clone from a trusted remote is safe since it does not copy the source .git/config; (2) before opening any external repo, inspect .git/config for filter.*.clean, filter.*.process, or attr.tree entries and strip them if unexpected; (3) where feasible, remove Git from PATH or run Codex Desktop in a restricted/sandboxed profile when reviewing untrusted code; (4) deploy EDR/detection rules for git.exe or git subprocess spawning unexpected child processes in the context of the Codex Desktop application; (5) track OpenAI's advisory for a patched Codex Desktop release and apply it as soon as available.

What does CISA's SSVC say?

DecisionTrack*

Exploitationnone

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAuth BypassPrivacy ViolationAgentAML.T0011- User Execution AML.T0050- Command and Scripting Interpreter AML.T0106- Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM08-Excessive Agency

Frequently Asked Questions

What is CVE-2026-19593?

OpenAI Codex Desktop automatically inspects Git metadata when a workspace is opened, and a preserved malicious .git/config can abuse Git's attr.tree setting alongside a configured clean or process filter to run an attacker-controlled program the moment the folder is opened — no model interaction, workspace-trust prompt, or command approval required. That program executes outside Codex's command sandbox with the full privileges of the signed-in developer, giving the attacker the ability to read, modify, or delete files and harvest any credentials available to that session. There is no CVSS score, EPSS data, CISA KEV listing, or public exploit yet, but the underlying mechanic is a well-documented Git attack class, and the delivery vector — a shared or downloaded repository with its .git/config intact, distinct from a plain `git clone` — is trivial to construct against developers who use Codex Desktop on Windows or macOS. Until OpenAI ships a patched build, treat any repository from outside your organization as untrusted before opening it in Codex Desktop: inspect .git/config for filter/clean/process directives first, open unknown repos in an isolated VM or without Git on PATH, and alert on unexpected child processes spawned by git under the Codex Desktop process tree.

Is CVE-2026-19593 actively exploited?

No confirmed active exploitation of CVE-2026-19593 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-19593?

No patched version is published yet (affected products show no fixed version for either the npm or Microsoft Store builds), so mitigation is procedural: (1) do not open repositories obtained as raw folders/zips/network shares (which can carry a live .git/config) in Codex Desktop unless their origin is fully trusted — a normal `git clone` from a trusted remote is safe since it does not copy the source .git/config; (2) before opening any external repo, inspect .git/config for filter.*.clean, filter.*.process, or attr.tree entries and strip them if unexpected; (3) where feasible, remove Git from PATH or run Codex Desktop in a restricted/sandboxed profile when reviewing untrusted code; (4) deploy EDR/detection rules for git.exe or git subprocess spawning unexpected child processes in the context of the Codex Desktop application; (5) track OpenAI's advisory for a patched Codex Desktop release and apply it as soon as available.

What systems are affected by CVE-2026-19593?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local developer tooling / IDE integrations, CI/CD credential stores.

What is the CVSS score for CVE-2026-19593?

CVE-2026-19593 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal developer tooling / IDE integrationsCI/CD credential stores

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

AML.T0106Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.

Exploitation Scenario

An attacker packages a booby-trapped project — for example, disguised as a helpful AI agent template or open-source ML utility — as a downloadable archive or network-share folder that preserves a full .git directory, including a .git/config with a filter.clean or filter.process directive pointing to a malicious script, plus matching .gitattributes/attr.tree settings. A developer downloads this and opens the folder directly in Codex Desktop to explore or extend it with AI assistance, without ever running `git clone`. The moment Codex Desktop inspects the working-tree Git status, Git evaluates the configured filter and launches the attacker's program with the developer's own privileges — silently, with no Codex sandbox restriction, no trust prompt, and no approval step. The program then harvests SSH keys, cloud credentials, and API tokens from the developer's machine, and can modify local files the developer later commits and pushes, propagating the compromise further.

Weaknesses (CWE)

CWE-15External Control of System or Configuration Setting CWE-15External Control of System or Configuration Setting

CWE-15 — External Control of System or Configuration Setting: One or more system settings or configuration elements can be externally controlled by a user.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
[Implementation, Architecture and Design] Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.

Source: MITRE CWE corpus.