Advisories › ACVE-2026-0443

ACVE-2026-0443

Codex Desktop before build 26.818.21641, running in read-only mode, let untrusted code use a token in the shared process heap to reach unsandboxed command execution.

Exposure

Harness

Codex Desktop before build 26.818.21641 — detected, www.accomplish.ai

Model

any — unconfirmed

Goal

Any task run in Codex Desktop read-only mode (goal not stated by the source) — unconfirmed

Tools and settings

The Codex Desktop JavaScript tool, shared process heap and read-only sandbox — confirmed, www.accomplish.ai

Approval

The token path ran in read-only mode without an approval prompt — detected, www.accomplish.ai

Input controlled by

repo-author

What the agent does

Untrusted code uses the shared token to reach command execution outside the sandbox.

Harm

arbitrary-command

Reach

The host process and its unsandboxed command execution — detected, www.accomplish.ai (the home directory, the network)

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Severity

HIGH

Status

Unverified

Kind

Code

Source date

2026-09-15

Modified

2026-09-25

Aliases

No CVE assigned — No CVE was assigned in the public disclosure.

Affected

• AgentHarness: codex-desktop — < 26.818.21641

Harness/product

codex-desktop

Classes

sandbox-escape; credential-exposure; command-injection; CWE-522; CWE-693

Taxonomy

ASI: ASI05; ASI: ASI03; ATLAS: AML.T0105

Licence

CC-BY-4.0 advisories; MIT code

Report a problemJSON