Four CVEs against OpenAI's Codex were published to the GitHub Advisory Database on 1 September at 18:30 UTC, entering from NVD rather than from a maintainer advisory. Each concerns a way an attacker-controlled .git/config turns Codex's own convenience features into code execution.
The mechanism
CVE-2026-19590 abuses core.hooksPath to point at attacker git hooks. CVE-2026-19592 uses core.fsmonitor, whose helper is executed during ordinary metadata collection. CVE-2026-19591 exploits PowerShell's --% stop-parsing token, which the command-safety parser misreads, letting an unapproved file-writing git command through. CVE-2026-19593 uses attr.tree with a clean or process filter to run an attacker program.
What the common framing gets wrong
These will read as four fresh holes. Three were closed in mid-May: the fix pull requests merged on 15 May, 14 May and 14 May respectively, so the shipped code has been fixed for over three months and the disclosure gaps run 109 to 110 days. The news is the lag and the empty fields, not fresh exposure. The second reflex — that the sandbox contained this — is contradicted by the advisories in their own words: the attacker code runs outside Codex's command sandbox, with no approval prompt and, in two cases, without any model interaction at all. Third, git clone is not the attack. All four require opening a repository whose local .git/config arrived intact — a zip, a copied directory, a shared volume — which a normal clone does not carry.
The records tell you almost nothing
All four carry severity “unknown” and no CVSS score at all, on either v3 or v4. More consequentially, the vulnerabilities array is empty on every one, so no advisory names an affected range or a patched version: there is no “upgrade to X” anywhere in the record. The fourth CVE references no fix pull request at all, leaving a reader unable to determine from the record whether it is fixed.
The pattern this belongs to
This is the agentic-coding threat model at its purest. The execution primitive is the agent's convenience — automatically reading git metadata when a workspace opens — and the sandbox everyone trusts is bypassed before the model is even consulted.