CVE-2026-19590Active Exploitation

MEDIUMCVSS 7.3 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.

Back to dashboard

5.0/ 10 priority

Sources & remediation

Other references

https://github.com/openai/codex/pull/22843

Weakness type (CWE)

CWE-427

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
2 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-09-01); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Active Exploitation

150.0%

Disclosure

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-01	1	Active Exploitation1
2026-09-14	1	Disclosure1

Full discourse2 posts

SystemTek - Technology news website@SystemTek_UK33d
Disclosure
OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability (CVE-2026-19590) https://www.systemtek.co.uk/2026/09/openai-codex-external-control-of-system-or-configuration-setting-remote-code-execution-vulnerability-cve-2026-19590/ via @SystemTek_UK
Post summary
The tweet announces a newly disclosed Remote Code Execution vulnerability in OpenAI Codex (CVE-2026-19590) and points to an article for further details.
0000043
1.8K followersView on X
Kaitan ID Security@KaitanSecurity46d
Active Exploitation
⚠️ HIGH — CVE-2026-19590 OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations… ⚡ Exploit in the wild Full analysis → https://sec.kaitan.id/cves/CVE-2026-19590 #OpenAI #CyberSecurity #InfoSec
Post summary
The post announces a high‑severity CVE (CVE-2026-19590) that allows attackers to execute attacker‑controlled Git hooks in OpenAI Codex Desktop through automated Git operations, notes that exploitation is occurring in the wild, and provides a link to a detailed analysis.
0000052
82 followersView on X

Explore more

Back to dashboard