AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-110930highCode execution2026-11-05

CVE-2026-110930: Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an at

Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments.

01.

What it is

Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.

02.

How to check

  1. Compare your installed version with the range above (command below).
03.

How to fix

    04.

    Sources

    More advisories for this tool
    The weekly email

    One email a week. Only what changed.

    Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

    Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.