ZDI-26-649: (Pwn2Own) OpenAI Codex Improper Neutralization of Control Sequences Remote Code Execution Vulnerability

Zerodayinitiative • September 10, 2026

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenAI Codex. User interaction is required to exploit this vulnerability in that the target must open a malicious folder.

The specific flaw exists within the parsing of arguments provided to git commands. The issue results from insufficient neutralization of control sequences. An attacker can leverage this vulnerability to execute code in the context of the current user.

OpenAI has issued an update to correct this vulnerability. More details can be found at:

2026-06-02 - Vulnerability reported to vendor

2026-09-10 - Coordinated public release of advisory

2026-09-10 - Advisory Updated

Cyrill Bannwart, Emanuele Barbeno, Yves Bieri, Lukasz D., Urs Mueller of Compass Security

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Remote Code Execution Vulnerabilities in OpenAI Codex Disclosed Four vulnerabilities affecting OpenAI Codex have been disclosed, all allowing remote code execution via user interaction. These vulnerabilities arise from improper handling of control sequences and lack of sanitization of configuration settings. Users must either open a malicious folder or visit a malicious page to exploit these vulnerabilities. The vulnerabilities are identified as ZDI-26-649, ZDI-26-648, ZDI-26-651, and ZDI-26-650, with the first two requiring interaction with malicious files or pages, while the latter two involve malicious folders. OpenAI has issued updates to address these vulnerabilities. The advisories were publicly released on September 10, 2026, following their reporting to the vendor on June 2, 2026. The vulnerabilities impact installations of OpenAI Codex, potentially allowing attackers to execute arbitrary code in the context of the current user. 4 sources 46

Extracted Entities

ZDI-26-649: (Pwn2Own) OpenAI Codex Improper Neutralization of Control Sequences Remote Code Execution Vulnerability

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Tools (2)

Vulnerabilities (2)