{"id":"CVE-2026-110930","published":"2026-11-05T20:17:40.827","lastModified":"2026-11-05T21:18:35.430","description":"Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects \"Open project in ChatGPT\" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval.","cvssScore":8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-88"],"vendors":[],"products":[],"references":[{"url":"https://openai.com/security/advisories/cve-2026-110930/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}