{"id":"CVE-2026-110930","kind":"vulnerability","aliases":["CVE-2026-110930"],"related":[],"title":"Codex Desktop for Windows: crafted File Explorer library path can run attacker code at startup","description":"Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects \"Open project in ChatGPT\" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.","summary":"Codex Desktop for Windows did not handle quotation marks in project paths from File Explorer. A path in an attacker's .library-ms library could inject extra startup arguments, which could run attacker code as the current Windows user before sign-in or project approval. OpenAI reports no known abuse in the wild.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Codex Desktop (Windows application)","fixed":["26.1007.21434"],"affected":">= 26.820.60940, <= 26.1002.52244","ecosystem":"vendor"},{"name":"Codex Desktop (Windows Microsoft Store package)","fixed":["26.1007.2314.0"],"affected":">= 26.820.7780.0, <= 26.1002.7124.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-coding-agent","ai-tooling","argument-injection","codex","codex-desktop","windows"],"not_affected_if":["codex-cli","codex-not-installed","linux","macos","not-windows","patched-version"],"how_to_check":"Open Codex Desktop on Windows and check its version. Affected: application 26.820.60940 through 26.1002.52244; Microsoft Store package 26.820.7780.0 through 26.1002.7124.0 (inclusive). Fixed: 26.1007.21434 (Store 26.1007.2314.0) or later.","fix":"Update Codex Desktop for Windows to 26.1007.21434 (Microsoft Store package 26.1007.2314.0) or later.","status":"open","published_at":"2026-11-05T20:17:40+00:00","first_seen_at":"2026-11-05T20:40:44+00:00","triaged_at":"2026-11-05T20:43:36+00:00","updated_at":"2026-11-05T20:45:15+00:00","category":"ai-tooling","confidence":0.9,"triage":{"at":"2026-11-05T20:43:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Codex Desktop for Windows: quote handling in project paths runs attacker code","impact":"high","summary":"Codex Desktop for Windows does not correctly handle quotation marks in project paths opened from Windows Explorer. A crafted folder path can inject extra startup arguments, letting an attacker run code as the current Windows user before sign-in or project trust approval.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["codex","windows","ai-coding-agent"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker code runs as the current Windows user before sign-in","analyst_note":"Find the vendor advisory or fixed Codex Desktop version for CVE-2026-110930; the NVD entry gives no product ranges.","how_to_check":"- Check whether Codex Desktop is installed on Windows machines and note its version.\n- Look for any version listed as fixed in the vendor or NVD entry for CVE-2026-110930.","plain_action":"","needs_analyst":true,"not_affected_if":["not-windows","codex-not-installed"],"who_is_affected":"Windows users of Codex Desktop who open project folders from Windows Explorer with the 'Open project in ChatGPT' menu item. The attack needs a user to select that item on an attacker-controlled library's child item, so teams that do not use Codex Desktop on Windows can skip it. The sources do not list affected version ranges.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4228,"output_tokens":557,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vendor advisory or fixed Codex Desktop version for CVE-2026-110930; the NVD entry gives no product ranges.","search":"'-110930':18A,21A '-2026':17A,20A 'abus':98B 'add':138C 'agent':35B 'ai':33B,37B 'ai-coding-ag':32B 'ai-tool':36B 'applic':139C 'application':25A 'approv':93B,164C 'argument':40B,76B,141C,143C 'argument-inject':39B 'attack':12A,66B,80B,129C,147C 'attacker-control':128C,146C 'chatgpt':125C 'check':109C 'child':133C 'code':13A,34B,81B,149C 'codex':1A,22A,26A,42B,44B,47B,102C 'codex-desktop':43B 'control':130C,148C 'correct':108C 'could':72B,78B 'craft':5A 'current':84B,152C 'cve':16A,19A 'desktop':2A,23A,27A,45B,48B,103C 'explor':7A,61B,117C 'extra':74B 'file':6A,60B 'handl':53B 'inject':41B,73B 'item':134C 'known':97B 'librari':8A,69B,71B,131C 'library-m':68B 'mark':55B,111C 'microsoft':29A 'ms':70B 'open':122C 'openai':94B 'package':31A 'path':9A,58B,63B,114C,136C 'permiss':156C 'project':57B,92B,113C,123C,162C 'quotat':54B,110C 'report':95B 'run':11A,79B,145C 'select':121C 'sign':89B,159C 'sign-in':88B,158C 'startup':15A,75B,140C 'store':30A 'tool':38B 'trust':163C 'user':86B,120C,154C 'wild':101B 'window':4A,46B,50B,85B,105C,116C,153C 'windows':24A,28A","nicknames":[],"mitigations":[],"who_affected":"Windows users running Codex Desktop in the affected version ranges. Exploitation needs Codex fully closed (no ChatGPT.exe running), Windows 11, and the user opening an attacker's .library-ms file in File Explorer, expanding the library, and choosing Open project in ChatGPT from the modern right-click menu on an item in it. Anyone on 26.1007.21434 or later, or not on Windows, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-05T20:45:15Z","by":"analyst","doc":"https://openai.com/security/advisories/cve-2026-110930","run_id":1827},"products":{"at":"2026-11-05T20:45:15Z","by":"analyst","doc":"https://openai.com/security/advisories/cve-2026-110930","run_id":1827},"how_to_check":{"at":"2026-11-05T20:45:15Z","by":"analyst","doc":"https://openai.com/security/advisories/cve-2026-110930","run_id":1827},"who_affected":{"at":"2026-11-05T20:45:15Z","by":"analyst","doc":"https://openai.com/security/advisories/cve-2026-110930","run_id":1827}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["codexdesktopwindowsapplication","codexdesktopwindowsmicrosoftstorepackage","desktopwindowsapplication","desktopwindowsmicrosoftstorepackage"],"ptokens":["application","codex","desktop","microsoft","package","store","windows"],"labels":["aicodingagent","aitooling","argumentinjection","codex","codexdesktop","high","windows"],"campaign_type":null,"first_public_at":"2026-11-05T20:17:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110930","severity":null,"published_at":"2026-11-05T20:17:40+00:00","modified_at":"2026-11-05T20:17:40+00:00","first_seen_at":"2026-11-05T20:40:44+00:00","fetched_at":"2026-11-05T20:40:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110930:1827","url":"https://openai.com/security/advisories/cve-2026-110930","severity":null,"published_at":"2026-11-05T20:45:15+00:00","modified_at":"2026-11-05T20:45:15+00:00","first_seen_at":"2026-11-05T20:45:15+00:00","fetched_at":"2026-11-05T20:45:15+00:00","note":"Read OpenAI advisory (Nov 3 2026): affected ranges and fix 26.1007.21434 / Store 26.1007.2314.0. No exploitation known; no social search done (fresh CVE).","cites":["https://openai.com/security/advisories/cve-2026-110930","https://cve.report/CVE-2026-110930"]}],"documents":[{"id":80068,"url":"https://openai.com/security/advisories/cve-2026-110930","title":"OpenAI advisory CVE-2026-110930","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":80069,"url":"https://cve.report/CVE-2026-110930","title":"CVE-2026-110930 CVE.report (CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}