OpenAI Codex Desktop (Microsoft Store package)

• CVE-2026-19592 High 7.3 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If 0.2%
• CVE-2026-19593 Critical 9.8 OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-c 0.5%
• CVE-2026-19591 High 8.8 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's st 0.6%
• CVE-2026-19590 High 7.3 OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attack 0.2%