{"affected":[{"product":"Codex Desktop for Windows","source":"CNA: OAI","vendor":"OpenAI","versions":[{"lessThanOrEqual":"26.1002.52244","status":"affected","version":"26.820.60940","versionType":"custom"},{"status":"unaffected","version":"26.1007.21434"}]},{"product":"Codex Desktop for Windows (Microsoft Store/MSIX package)","source":"CNA: OAI","vendor":"OpenAI","versions":[{"lessThanOrEqual":"26.1002.7124.0","status":"affected","version":"26.820.7780.0","versionType":"custom"},{"status":"unaffected","version":"26.1007.2314.0"}]}],"cveId":"CVE-2026-110930","cwes":["CWE-88"],"description":"Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects \"Open project in ChatGPT\" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793910511390,"publishedAt":1793908530438,"references":[{"source":"CNA: OAI","tags":[],"url":"https://openai.com/security/advisories/cve-2026-110930/"}],"remediation":[{"kind":"fix","source":"CNA: OAI","text":"Install application 26.1007.21434 (Microsoft Store/MSIX 26.1007.2314.0) or later."}],"revision":"4a4999b0e7b290caef9095edbcd673fa726927f5ae71336fd06d959ac07128c2","sources":[{"modifiedAt":1793910511390,"name":"CNA: OAI","retrievedAt":1793913735382,"url":"https://www.cve.org/CVERecord?id=CVE-2026-110930"}],"ssvc":{"assessedAt":1793910492900,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2026-110930","updatedAt":1793913735382}