Code Execution Vulnerability in Codex Desktop for Windows by OpenAI
CVE-2026-110930

8HIGH

Key Information:

Vendor

Openai

Status
Codex Desktop For Windows
Codex Desktop For Windows (microsoft Store/msix Package)
Vendor
CVE Published:
5 November 2026

What is CVE-2026-110930?

Codex Desktop for Windows has a vulnerability where it fails to properly validate quotation marks in project paths sourced from Windows Explorer. An attacker can exploit this by selecting 'Open project in ChatGPT' for a child item in a malicious library, allowing them to inject application startup arguments. This could lead to the execution of arbitrary code with the current user's permissions, posing significant security risks prior to user authentication or project trust approval.

Affected Version(s)

Codex Desktop for Windows 26.820.60940 <= 26.1002.52244

Codex Desktop for Windows (Microsoft Store/MSIX package) 26.820.7780.0 <= 26.1002.7124.0

Codex Desktop for Windows 26.1007.21434

References

https://openai.com/security/advisories/cve-2026-110930/

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ikotas Labs, Inc. (@ikotas00), through Trend Micro Zero Day Initiative.
.