CVE-2026-19592

OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens an attacker-prepared repository whose preserved .git/config specifies an attacker-controlled f...