CVE-2026-110930

LOWCVSS 8.0 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://openai.com/security/advisories/cve-2026-110930/

Weakness type (CWE)

CWE-88

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Referenced assets2 URLs

By indicator

Full discourse2 posts

CERT-PY@CERTpy1d
⚠️ Vulnerabilidad en OpenAI Codex Desktop ❗ CVE-2026-110930 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-openai-codex-desktop/ https://t.co/QJ6f4HGudK
05060615
6.7K followersView on X
Saul Felipe Ramirez@SaFeRamirez1d
Codex Desktop (Windows): comillas en la ruta al abrir desde Explorer inyectaban args. Corre código antes del login/trust. Actualiza a 26.1007.21434+. https://nvd.nist.gov/vuln/detail/CVE-2026-110930
0000044
302 followersView on X

Explore more

Back to dashboard