CyberRota Analysis
AI-GeneratedOpenAI Codex Desktop for Windows is vulnerable to exploitation through malicious Git configurations in user workspaces, allowing an attacker to execute arbitrary programs with the signed-in user's privileges. This could lead to unauthorized access, modification, or deletion of files, as well as exposure of user credentials. Organizations using OpenAI Codex should prioritize this vulnerability, particularly those with users who frequently interact with Git repositories.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree setting and a configured clean or process filter can cause Git to run an attacker-controlled program. The program runs outside Codex's command sandbox with the signed-in user's privileges, without a workspace-trust prompt, command approval, or interaction with a model. The attacker can read, modify, or delete files and access credentials available to that user. Exploitation requires Git to be available on PATH and the user to open the attacker-prepared repository with its local Git configuration intact. An ordinary Git clone does not copy the source repository's .git/config and is not sufficient by itself.