CVE-2026-110930
Summary
| CVE | CVE-2026-110930 |
|---|---|
| State | PUBLISHED |
| Assigner | OAI |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-05 20:17:40 UTC |
| Updated | 2026-11-05 20:17:40 UTC |
| Description | Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval. |
Risk And Classification
Problem Types: CWE-88 | CWE-88 CWE-88: Argument Injection
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | OpenAI | Codex Desktop For Windows | affected 26.820.60940 26.1002.52244 custom | Not specified |
| CNA | OpenAI | Codex Desktop For Windows | unaffected 26.1007.21434 | Not specified |
| CNA | OpenAI | Codex Desktop For Windows Microsoft Store/MSIX Package | affected 26.820.7780.0 26.1002.7124.0 custom | Not specified |
| CNA | OpenAI | Codex Desktop For Windows Microsoft Store/MSIX Package | unaffected 26.1007.2314.0 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| openai.com/security/advisories/cve-2026-110930 | 8f4f43ab-ba69-4d92-aa1d-d772184d6fb7 | openai.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Ikotas Labs, Inc. (@ikotas00), through Trend Micro Zero Day Initiative. (en)
Additional Advisory Data
Solutions
CNA: Install application 26.1007.21434 (Microsoft Store/MSIX 26.1007.2314.0) or later.
There are currently no legacy QID mappings associated with this CVE.