DIGGINGBEAGLE

Case · DiggingBeagle record

Two Codex malicious-repository flaws could execute code as the current user

ZDI disclosed two patched OpenAI Codex vulnerabilities from Pwn2Own: CVE-2026-19590 in configuration handling and CVE-2026-19591 in Git argument/control-sequence handling. Both scored CVSS 7.8 and could execute code as the current user after the victim opened attacker-controlled content or a malicious folder. The advisories do not establish exploitation in the wild.

Scope

Two separately disclosed, patched Codex vulnerabilities from Pwn2Own. They share a malicious-content prerequisite and current-user code-execution impact but are not one exploit chain.

Assessment profile

Assessment method
Setting
research demonstration
Exploitation
demonstrated
Remediation
fixed reported
AI role
AGAINST AI
Basis and provenance

The recorded ZDI Pwn2Own disclosures describe two separate demonstrated current-user execution flaws and vendor patches. Source-ID-only locators leave evidence grading pending; no in-the-wild campaign is established. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded. Stored evidence uses source-level locators; passage-level corroboration remains required.

Assessed Sep 24, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-WILD · CLM-19590 · CLM-19591 · CLM-PATCH · CLM-SEVERITY · CLM-DISCLOSURE · CLM-USERACTION · ZDI-26-648 / CVE-2026-19590 · ZDI-26-649 / CVE-2026-19591

At a glance

Mechanism and trust boundary

  1. 01

    Prepare attacker-controlled project content

    The attacker supplies malicious content, a file or a folder that will be opened in the affected Codex workflow.

    Boundary: untrusted repository content / local agent environment

  2. 02

    Variant A reaches unsafe configuration handling

    CVE-2026-19590 turns attacker-controlled content opened by the target into a configuration-handling code-execution path.

    Boundary: project configuration / process execution

  3. 03

    Variant B reaches Git argument handling

    CVE-2026-19591 abuses insufficient neutralization of control sequences in Git command arguments after a malicious folder is opened.

    Boundary: repository metadata or arguments / Git process invocation

  4. 04

    Code executes as the current user

    Both advisories describe execution in the security context of the user running Codex.

    Boundary: coding-agent workflow / host user authority

Timeline

  1. Jun 2, 2026
    discovery

    Both vulnerabilities reported to OpenAI

    ZDI records June 2 as the report date for both Pwn2Own findings.

  2. Sep 10, 2026
    Event type unspecified

    Coordinated ZDI advisories published

    The two patched vulnerabilities are publicly disclosed; the advisories do not report in-the-wild exploitation.

Claims & evidence

CLM-WILDThe ZDI advisories do not establish exploitation in the wild.supported

Basis: reported finding

  • supports
    ZDI-26-649 / CVE-2026-19591role not specified

    Vulnerability details and disclosure timeline; no in-the-wild exploitation finding

Link to claim
CLM-19590ZDI-26-648 / CVE-2026-19590 describes unsafe configuration handling leading to code execution after attacker-controlled content is opened.supported

Basis: reported finding

Link to claim
CLM-19591ZDI-26-649 / CVE-2026-19591 describes insufficient neutralization of control sequences in Git command arguments, allowing code execution from a malicious folder.supported

Basis: reported finding

Link to claim
CLM-PATCHZDI states OpenAI issued updates correcting both vulnerabilities before coordinated public disclosure.supported

Basis: reported finding

Link to claim
CLM-SEVERITYBoth vulnerabilities carry CVSS 7.8 and allow code execution in the context of the current user.supported

Basis: reported finding

Link to claim
CLM-DISCLOSUREBoth vulnerabilities were reported to OpenAI on June 2, 2026 and publicly disclosed in coordinated ZDI advisories on September 10, 2026.supported

Basis: reported finding

Link to claim
CLM-USERACTIONCVE-2026-19590 requires the target to visit malicious content or open a malicious file; CVE-2026-19591 requires opening a malicious folder.supported

Basis: reported finding

Link to claim

Implications

A coding agent's repository boundary is also a host-execution boundary. Opening a project is not equivalent to reading inert text when the surrounding tooling interprets configuration, Git arguments or other project-controlled state. Security review should therefore treat malicious repositories as active input to the whole harness, not only as prompt-injection material.

Controls and mitigations

  • Run patched Codex versions containing OpenAI's fixes for both advisories.
  • Treat untrusted repositories, configuration and Git metadata as potentially executable input.
  • Use least-privilege or disposable environments when opening attacker-controlled projects.
  • Keep process-spawning and Git argument construction separate from model-controlled or repository-controlled strings.

Unknowns and contradictions

  • Public advisories provide limited detail on affected version ranges and do not quantify exposed installations.

Sources and citation

EvidenceZDI-26-649 / CVE-2026-19591EvidenceZDI-26-648 / CVE-2026-19590

Material revision history

  1. Sep 18, 2026 · Published version · first publication · revision 4
  2. Sep 19, 2026 · Published version · material revision · revision 17Public fields changed: attack_path, implications, mitigations, narrative, scope, timeline
  3. Sep 25, 2026 · Published version · material revision · revision 37Public fields changed: assessment_profile
  4. Oct 8, 2026 · Published version · material revision · revision 99Public fields changed: claims
Record metadata

Canonical ID: CASE-2026-CODEX-REPO-RCE · revision 99

Legacy date (semantics unspecified): 2026-09-10. This value is not treated as an occurrence or disclosure date.