OpenAI's November 3 advisory describes a project-opening path that processed attacker-controlled command-line arguments before sign-in or project trust. On an affected Windows build, a crafted .library-ms file could supply a quoted project path that changed startup argument interpretation and reached code execution under the current user's identity. The…
Case · DiggingBeagle record
Codex Desktop for Windows executed project-path arguments before trust checks
A crafted Windows library file could inject startup arguments through an Explorer project-opening action. The advisory requires specific local interaction and affected builds; it does not describe a remote zero-click attack.
Public disclosure: Nov 3, 2026
Scope
Vulnerability reported in a controlled research or disclosure setting. Exact prerequisites, versions and absence of documented exploitation must be preserved.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited first-party advisory or research establishes the stated mechanism only within its documented conditions. No unrelated production compromise, extended victim scope, financial harm or universal mitigation is inferred.
Assessed Nov 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CODEX-PRETRUST-WINDOWS · OpenAI Codex Desktop Windows project-path code execution advisory
At a glance
The trust dialog and login have not yet been reached when the untrusted path affects application startup.
Read the implicationsRequires explicit interaction with the file in Windows; not a remote no-click exploit or known victim campaign.
Limits and uncertaintyFull account
OpenAI's November 3 advisory describes a project-opening path that processed attacker-controlled command-line arguments before sign-in or project trust. On an affected Windows build, a crafted .library-ms file could supply a quoted project path that changed startup argument interpretation and reached code execution under the current user's identity.
The documented sequence requires a fully closed application, opening and expanding the library file in Windows 11 Explorer, and selecting the modern context-menu action to open the project. A delivered file alone is not the demonstrated trigger.
Affected builds and fix
The advisory lists application versions 26.820.60940 through 26.1002.52244 and Store versions 26.820.7780.0 through 26.1002.7124.0. Fixed versions are 26.1007.21434 and Store 26.1007.2314.0. OpenAI reported no known exploitation in the wild.
The important ordering failure occurs before an agent evaluates repository content: untrusted launch input reaches executable application behavior before the intended trust decision. Updating the affected application addresses the disclosed defect; the evidence does not imply a Linux issue, an arbitrary browser attack or bypass of every desktop permission mechanism.
Mechanism and trust boundary
- 01
An attacker convinces a user to open an attacker-controlled Windows library/project path in File Explorer.
- 02
The user chooses the relevant Open project in ChatGPT/Codex shell action, passing the path to the desktop process.
- 03
Unescaped path quoting changes the application startup argument boundary before the application prompts for project trust.
Claims & evidence
CLM-CODEX-PRETRUST-WINDOWSOpenAI states that Windows Codex Desktop versions 26.820.60940 through 26.1002.52244 could execute attacker-supplied code with the user privileges when opened through crafted File Explorer project-path handling before sign-in/trust; fixed in 26.1007.21434.supported
Basis: reported finding
- supportsOpenAI Codex Desktop Windows project-path code execution advisoryvendor statement
CVE-2026-110930 advisory: Affected and fixed versions, attack mechanism and mitigation
CLM-ENR231-CODEX-INTERACTION-CONDITIONSOpenAI specifies that triggering the Windows library path flaw required a fully closed desktop process and an explicit File Explorer Open project in ChatGPT action; it reports no known exploitation in the wild.supported
Basis: reported finding
- supportsOpenAI Codex Desktop Windows project-path code execution advisoryvendor statement
Conditions, Known exploitation and Affected products & versions sections
Implications
The trust dialog and login have not yet been reached when the untrusted path affects application startup.
Controls and mitigations
- Upgrade to desktop version 26.1007.21434 or later; treat untrusted shell-integrated project paths as untrusted arguments before initiating the app.
Unknowns and contradictions
- Requires explicit interaction with the file in Windows; not a remote no-click exploit or known victim campaign.
Sources and citation
Material revision history
- Nov 9, 2026 · Published version · first publication · revision 233