Disclosed vulnerability
CVE-2026-19591: Codex CLI and Desktop misread PowerShell's stop-parsing token as safe, letting an attacker-prepared repository rewrite Codex's config and launch a malicious MCP server without approval
AIR-2026-0218 AIR record · 2026-09-openai-codex-powershell-stop-parsing-approval-bypass
From the supporting source
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself.cveawg.mitre.org
The record
Disclosed
2026-09-01
Vendor
OpenAI
Product
OpenAI Codex CLI and Codex Desktop
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Privilege escalation
System type
Generative model
Who acted
AI was the target — a command-safety parser flaw in the coding agent's tooling; no model decision
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Malicious repository
Impact type
Code execution, Approval bypass
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Codex CLI users on Windows, macOS and Linux and Codex Desktop users who open an attacker-prepared repository; macOS and Linux additionally need PowerShell Core installed; the default filesystem sandbox on macOS and Linux can block the config write
Capability abused
Defense & remediation
Recorded defense
Codex command sandbox and approval prompts
Guardrail kinds
Human approval, Sandbox isolation
Guardrail outcome
Silent
Fix shipped
Codex CLI (PR openai/codex#22643); Codex Desktop fixed builds
Taxonomy & references
Curator notes
OpenAI-assigned CVE published 2026-09-01 (reporter Compass Security per CVE Brief; CVSS 8.8). Re-scoped 2026-09-21: the sibling CVE-2026-19593 (Codex Desktop auto-executing an attacker-controlled .git/config via attr.tree and clean/process filters when a workspace is opened) is the Codex instance of the GitSpawn class and now lives on the GitSpawn record (2026-09-manifold-gitspawn), so each CVE is held once. Mechanism here: the command-safety parser treats PowerShell's --% token differently from PowerShell, so a file-writing Git command runs without approval; if filesystem protections permit the write, Codex's configuration can be modified and a later load launches an attacker-controlled MCP server with the user's privileges. The bypass does not disable filesystem sandboxing. PoC/disclosure; no real victim.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-19591: Codex CLI and Desktop misread PowerShell's stop-parsing token as safe, letting an attacker-prepared repository rewrite Codex's config and launch a malicious MCP server without approval". AIR, AIR-2026-0218. https://agentincident.vercel.app/i/AIR-2026-0218/ (accessed 2026-10-19).