CVE-2026-110930

Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects "Open project in ChatGPT" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.

• CWE-88

• https://openai.com/security/advisories/cve-2026-110930/

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-110923Rejected reason: CVE-2026-110923 has been marked as a duplic…
• CVE-2026-110924Rejected reason: CVE-2026-110924 has been marked as a duplic…
• CVE-2026-110925Rejected reason: CVE-2026-110925 has been marked as a duplic…
• CVE-2026-110926Rejected reason: CVE-2026-110926 has been marked as a duplic…
• CVE-2026-110927Rejected reason: CVE-2026-110927 has been marked as a duplic…
• CVE-2026-11093Inappropriate implementation in Printing in Google Chrome pr…6.5
• CVE-2026-110931A flaw was found in the SAML 1.1 assertion parser of Keycloa…7.5
• CVE-2026-110932A flaw was found in the theme resource endpoint of Keycloak,…7.5
• CVE-2026-110933Uncaught exception vulnerability in Samsung Open Source Vyon…4.4
• CVE-2026-110934Improper validation of array index vulnerability in Samsung …4.4
• CVE-2026-110935The PFI plugin framework deployment routine does not validat…8.4
• CVE-2026-110936A vulnerability has been identified in Siemens Software Cent…6.7