CVE-2026-110930

What it is

Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account, but needs a user to act. High risk of data exposure, data tampering, service disruption.

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-10-15 04:34 UTC ReservedThe CVE id was reserved by its CNA
2. 2026-11-05 20:17 UTC PublishedDisclosed publicly on CVE.org and NVD
3. 2026-11-05 21:18 UTC Last updatedMost recent change to the record

Details

Published

2026-11-05 20:17 UTC

Last modified

2026-11-05 21:18 UTC

Weakness

CWE-88

Record status

Received

Attack profile CVSS 3.1 · 8.0

Attack vector

Network

Complexity

Low

Privileges needed

Low

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High