{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-110930","assignerOrgId":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","state":"PUBLISHED","assignerShortName":"OAI","dateReserved":"2026-10-15T04:34:40.626Z","datePublished":"2026-11-05T19:55:30.438Z","dateUpdated":"2026-11-05T20:28:31.390Z"},"containers":{"cna":{"providerMetadata":{"orgId":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","shortName":"OAI","dateUpdated":"2026-11-05T19:55:30.438Z"},"descriptions":[{"lang":"en","value":"Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects \"Open project in ChatGPT\" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval."}],"affected":[{"vendor":"OpenAI","product":"Codex Desktop for Windows","versions":[{"version":"26.820.60940","status":"affected","versionType":"custom","lessThanOrEqual":"26.1002.52244"},{"version":"26.1007.21434","status":"unaffected"}]},{"vendor":"OpenAI","product":"Codex Desktop for Windows (Microsoft Store/MSIX package)","versions":[{"version":"26.820.7780.0","status":"affected","versionType":"custom","lessThanOrEqual":"26.1002.7124.0"},{"version":"26.1007.2314.0","status":"unaffected"}]}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-88: Argument Injection","cweId":"CWE-88","type":"CWE"}]}],"credits":[{"lang":"en","value":"Ikotas Labs, Inc. (@ikotas00), through Trend Micro Zero Day Initiative."}],"references":[{"url":"https://openai.com/security/advisories/cve-2026-110930/"}],"configurations":[{"lang":"en","value":"On Windows, Codex Desktop must be fully closed, with no ChatGPT.exe process running. The user must open an attacker-controlled .library-ms file in File Explorer. The user must expand the library in the left navigation pane. The user must right-click the library's child item and select \"Open project in ChatGPT\" from the modern Windows 11 context menu."}],"solutions":[{"lang":"en","value":"Install application 26.1007.21434 (Microsoft Store/MSIX 26.1007.2314.0) or later."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-11-05T20:28:12.900578Z","id":"CVE-2026-110930","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-11-05T20:28:31.390Z"}}]}}