Description

Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-11-05T20:17:40.827Z",
  "pubdate": "2026-11-05T20:17:40.827Z",
  "executiveSummary": "Codex Desktop for Windows contains an argument injection vulnerability stemming from improper sanitization of file paths processed via Windows Explorer integration.\nThe vulnerability manifests when the 'Open project in ChatGPT' context menu action is invoked on a specially crafted, attacker-controlled file path that lacks proper quotation marks.\nThis flaw allows an attacker to inject arbitrary command-line arguments into the application startup process, leading to the execution of attacker-supplied code within the security context of the current Windows user.\nThe attack is highly critical as it bypasses standard project trust approval mechanisms and executes code prior to user authentication or formal validation of the target directory.\nThe primary risk involves unauthorized code execution on the local host, potentially leading to full compromise of the user's session and persistence within the environment.\nExploitation requires minimal user interaction, specifically the selection of a malicious path through the Windows shell integration.",
  "technicalDetails": "The root cause of this vulnerability is improper handling of path strings when Codex Desktop receives input from the Windows Explorer context menu.\nWhen a user interacts with a directory or file via the 'Open project in ChatGPT' shell extension, the application parses the provided path string as an argument to the main executable.\nThe application fails to correctly wrap these paths in double quotes or perform sufficient input validation/sanitization before passing them to the underlying shell execution or process spawning routines.\nAn attacker can exploit this by creating a directory or file structure with a name designed to break out of the intended argument context, such as a path containing strings like ' --custom-flag=value' or paths that terminate the primary argument and initiate additional command-line parameters.\nBy manipulating the path, an attacker can append flags that the Codex Desktop executable interprets as instructions, such as remote debugging hooks, loading external scripts, or altering the runtime environment to execute malicious payloads.\nThe attack flow follows these steps: 1) The attacker places a malicious path or directory structure on a accessible filesystem (e.g., a shared network drive or removable media). 2) The victim right-clicks the item in Windows Explorer and selects 'Open project in ChatGPT'. 3) The shell extension triggers the Codex Desktop process with the unquoted, malicious path string. 4) The application parses the malicious argument, resulting in the execution of injected commands or the loading of an arbitrary configuration.\nBecause the execution occurs via the application's startup routine, the payload is executed with the current Windows user's privileges. This facilitates a privilege escalation-like scenario where the attacker's code inherits the permissions of the authenticated user.\nThis vulnerability is particularly dangerous because it bypasses existing application-level security features, such as 'Project Trust' prompts, as the exploitation occurs during the process initialization phase, often before the UI or safety checks have been fully instantiated."
}