Vibe Coding
CVE-2026-19591: Codex CLI misread PowerShell's `--%` stop-parsing token and ran Git writes without approval
Published to NVD on 2026-09-01, this flaw affects Codex CLI on Windows, macOS and Linux plus Codex Desktop: the command-safety parser interpreted PowerShell's stop-parsing token `--%` differently than PowerShell itself, so certain commands were misclassified as safe. An attacker-prepared repository could get Codex to run a file-writing Git command with no approval prompt, overwrite Codex's own config, and have it launch an attacker-controlled MCP server on next load. The fix (openai/codex PR #22643) treats stop-parsing forms as unsupported in the AST-backed command flattener; the default filesystem sandbox on macOS and Linux still limits writes.
Source
↳ Follow the thread