Disclosed vulnerability
GitPwned: git show is on Codex CLI's safe-command allowlist, but --output writes arbitrary content to arbitrary paths
AIR-2026-0167 AIR record · 2026-07-openai-codex-gitpwned-git-show
From the supporting source
Commands aren't inherently safe or dangerous; invocations are. git show HEAD is harmless. git show --output=.git/config HEAD can write attacker-controlled content to a sensitive file.pillar.security
The record
Disclosed
2026-07-20
Vendor
OpenAI
Product
OpenAI Codex CLI
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent used an allowlisted git show --output to write arbitrary files
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection documentation
Impact type
Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Codex CLI users below v0.95.0 processing untrusted documentation
Capability abused
Defense & remediation
Recorded defense
safe-command allowlist; model refusal
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
patched 2026-02-04 in Codex CLI v0.95.0 (GHSA-w5fx-fh39-j5rw, CVSS 8.6)
Taxonomy & references
Curator notes
Pillar Security (Ariel Fogel), Day 5 of the 'Week of Sandbox Escapes'. Reported 2026-01-07, patched 2026-02-04, published 2026-07-20. Execution lands when the user later runs git diff. Also documents that model refusal is not a control: 'Model refusal is probabilistic, not deterministic.'
Supporting sources
Cite as
Enkrypt AI. "GitPwned: git show is on Codex CLI's safe-command allowlist, but --output writes arbitrary content to arbitrary paths". AIR, AIR-2026-0167. https://agentincident.vercel.app/i/AIR-2026-0167/ (accessed 2026-10-19).