Loading vulnerability…
GitSpawn: OpenAI Codex Git fsmonitor Command Execution
OpenAI Codex CLI and Codex Desktop automatically collected Git repository metadata while honoring the repository-local Git core.fsmonitor setting. An attacker can prepare and distribute a repository whose retained local Git configuration specifies an attacker-controlled filesystem-monitor helper. When Codex performs Git metadata operations, Git may execute that helper. Execution occurs outside Codex's command sandbox and without a user-approval prompt.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in arbitrary code execution under the privileges of the logged-in Codex user. The attacker-controlled code can read, modify, or delete files accessible to that user and access other resources available to the user account.
If you can’t patch tonight, do this now.
Do not open or use untrusted repositories delivered with their Git metadata intact. Before using a received repository, inspect its repository-local Git configuration and remove or unset core.fsmonitor. Administrators and users may also disable core.fsmonitor globally. Vendors invoking Git for background metadata collection can explicitly override core.fsmonitor to false for those calls.
Patch, then assume compromise.
Update affected Codex products to fixed releases: Codex CLI 0.131.0 or later; Codex Desktop for macOS 26.519.22136 or later; and Codex Desktop for Windows 26.519.21041 or later. For the Microsoft Store Windows package, update to 26.519.2081.0 or later.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.