CVE-2026-110930
CVSS Score
8.0
EPSS Score
0.0%
EPSS Percentile
0th
Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.
| CWE | CWE-88 |
| Vendor | openai |
| Product | codex desktop for windows |
| Published | Nov 5, 2026 |
| Last Updated | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for openai codex desktop for windows
Be the first to know when new high vulnerabilities affecting openai codex desktop for windows are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
OpenAI / Codex Desktop for Windows
26.820.60940 ≤ 26.1002.52244
OpenAI / Codex Desktop for Windows (Microsoft Store/MSIX package)
26.820.7780.0 ≤ 26.1002.7124.0
References
Credits
Ikotas Labs, Inc. (@ikotas00), through Trend Micro Zero Day Initiative.