OpenAI Codex Desktop Windows project-path code execution advisory

Evidence record

Read the original source ↗

Claim-level citations (2)

• supportsCodex Desktop for Windows executed project-path arguments before trust checks: OpenAI states that Windows Codex Desktop versions 26.820.60940 through 26.1002.52244 could execute attacker-supplied code with the user privileges when opened through crafted File Explorer project-path handling before sign-in/trust; fixed in 26.1007.21434.

  CVE-2026-110930 advisory: Affected and fixed versions, attack mechanism and mitigation

• supportsCodex Desktop for Windows executed project-path arguments before trust checks: OpenAI specifies that triggering the Windows library path flaw required a fully closed desktop process and an explicit File Explorer Open project in ChatGPT action; it reports no known exploitation in the wild.

  Conditions, Known exploitation and Affected products & versions sections