Description

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets core.fsmonitor to an attacker-controlled filesystem-monitor helper, Git can execute that helper while Codex collects repository metadata. The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges. The code can read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the source repository's local .git/config; exploitation requires a repository delivered or copied with that configuration intact.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-01T18:17:40.370Z",
  "pubdate": "2026-09-01T18:17:40.370Z",
  "executiveSummary": "This vulnerability is an arbitrary code execution flaw affecting OpenAI Codex CLI and Codex Desktop across Windows, macOS, and Linux platforms. The issue stems from the improper handling of Git repository metadata during the automatic collection process, specifically failing to disable or sanitize the repository-local core.fsmonitor configuration setting.\nAn attacker can exploit this by crafting a malicious Git repository that contains a pre-configured .git/config file where core.fsmonitor is set to an attacker-controlled helper executable. When a user interacts with this repository using the affected Codex tools, the application inadvertently executes the malicious helper with the privileges of the logged-in user. This bypasses existing command sandboxing and occurs without requesting user authorization.\nThe successful exploitation of this vulnerability allows an attacker to achieve full code execution within the context of the user's account. This grants the ability to read, modify, or delete arbitrary files, exfiltrate sensitive data, and access additional system resources available to the user. Exploitation requires the victim to open or utilize a repository containing the malicious configuration, typically delivered through means that preserve the .git/config file, such as direct cloning of a malicious source or manual extraction of a repository archive.",
  "technicalDetails": "The root cause of this vulnerability lies in the interaction between the Codex CLI/Desktop application and the Git subsystem during the automated metadata collection process. When the affected Codex software initializes or scans a Git repository, it triggers standard Git routines to gather information. However, the application fails to explicitly ignore or override the repository-local core.fsmonitor configuration parameter defined within .git/config.\nIn standard Git operations, the core.fsmonitor configuration allows users to define an external helper process to monitor file system changes, improving performance by reducing the need for full tree scans. Under normal circumstances, this helper is executed by the Git process. Because the Codex tools perform this metadata collection with the user's full privileges and outside of a restricted command sandbox, the underlying Git process inherits these elevated rights.\nThe attack flow proceeds as follows: First, the attacker creates a repository and modifies the .git/config file, setting the core.fsmonitor key to point to an arbitrary malicious binary included within the repository structure. Second, the attacker distributes this repository to a target. Exploitation is contingent upon the target user opening or using the repository in a way that triggers Codex's automatic metadata collection; a standard 'git clone' operation typically does not preserve this local configuration, so the attacker must rely on delivering the repository as a bundle, a zip archive, or via direct manual copy where the .git directory remains intact.\nUpon opening the repository in the vulnerable Codex tool, the application invokes Git commands to refresh repository state or metadata. Git observes the core.fsmonitor setting and initiates the execution of the specified helper script or binary. Because the Codex tool does not validate the helper path or implement a 'safe repository' check to prevent execution of untrusted hooks or plugins, the malicious code executes immediately without a user-approval prompt or security warning.\nThe resulting impact is the complete compromise of the user's session. The payload executes with the privileges of the user running the Codex tool. Post-exploitation capabilities include persistent access via backdoors, lateral movement within the local environment, or the theft of credentials and private keys stored in the user's home directory. Since the helper runs as a subprocess to the Git integration within Codex, it effectively bypasses standard command-line security boundaries."
}