CVE-2026-19591

OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) misclassified certain PowerShell commands as safe due to a command-safety parser that interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself. An attacker who plants instructions in a reposito...