Vulnerabilities in code written with ChatGPT/Codex

15 published CVEs and GitHub advisories where a change made with ChatGPT/Codex introduced the flaw, exposed the vulnerable path, or left a security fix incomplete, across 7 projects. Most common root cause: injection & unsafe execution.

Findings: 15; 5% of all 284
Projects: 7; Most: gitpython-developers/gitpython (8)
Critical or high: 7; of 8 with a severity score
Latest advisory: Aug 10, 2026; Data through Sep 26, 2026

Search and filter these findings →

Findings per month

May 2025Peak advisory month: Jul 2026Sep 2026

By advisory publication month. The latest month is partial.

Root causes

What went wrong in findings that involve ChatGPT/Codex.

How AI contributed

Whether the AI-assisted change introduced the flaw, widened exposure, or left a fix incomplete.

Languages

Primary language of the affected repository.

All 15 findings

Newest first

AI-written GitPython blame validation blocked only output options but missed file-reading options, allowing callers to read arbitrary files through a revision argument.
CVE-2026-78678Aug 10, 2026gitpython-developers/gitpythonPythonChatGPT/CodexFlawed AI-written codeInjection & unsafe execution
An AI-written hardening change checked split short-option values but not the joined form, so attacker-controlled keyword options to GitPython's clone could still smuggle in git's upload-pack option and run a command.
HighCVE-2026-76220Aug 7, 2026gitpython-developers/gitpythonPythonChatGPT/CodexIncomplete remediationInjection & unsafe execution
An AI-written option guard for GitPython's Repo.archive() and clone left --add-file, --add-virtual-file and --bundle-uri off its denylists, so caller-supplied keyword options could still read arbitrary local files into an archive or point a clone at an extra bundle.
MediumCVE-2026-73619Aug 3, 2026gitpython-developers/gitpythonPythonChatGPT/CodexIncomplete remediationPath & link handling
An AI-assisted change stopped environment expansion on clone URLs but left the same expansion in the remote and submodule callers, so a URL passed to create_remote or add could embed the hosting process's secrets and carry them to the attacker's host.
CVE-2026-73622Jul 24, 2026gitpython-developers/gitpythonPythonChatGPT/CodexIncomplete remediationValidation & fail-open logic
AI-written code validated unsafe options using only kwarg keys, allowing option tokens smuggled in values to bypass the guard and execute arbitrary commands.
HighCVE-2026-73625Jul 24, 2026gitpython-developers/gitpythonPythonChatGPT/CodexIncomplete remediationInjection & unsafe execution
AI-written code wrote unsanitized attacker-controlled submodule names into .git/config section headers, enabling config injection and arbitrary directive execution.
HighCVE-2026-69097Jul 20, 2026gitpython-developers/gitpythonPythonChatGPT/CodexIncomplete remediationInjection & unsafe execution
An AI-assisted pull request, marked [AI] per the repository's convention, tried to harden device.pair.approve by adding an approve-side role check, but applied it only to device-token callers, leaving the pre-existing flaw for other sessions.
CVE-2026-62218Jul 17, 2026openclaw/openclawTypeScriptChatGPT/CodexFlawed AI-written codeAuthentication & access control
An AI-written fix for unsafe git options left GitPython's ls_remote accepting unsafe ext:: transport URLs, so applications passing an attacker-chosen remote could still run a helper until 3.2.0.
HighCVE-2026-67323Jul 12, 2026gitpython-developers/gitpythonPythonChatGPT/CodexFlawed AI-written codeInjection & unsafe execution
The AI-attributed change, written with OpenAI GPT-5 via Codex desktop, introduced terminal handlers that spawn and drive an interactive shell without a separate authentication gate.
CriticalCVE-2026-58123Jul 10, 2026nesquena/hermes-webuiPythonChatGPT/CodexDirect introductionAuthentication & access control
Vitest's AI-written code exposed an ungated CDP API, letting clients bypass disabled write/exec restrictions to achieve remote code execution.
CriticalCVE-2026-53633Jun 15, 2026vitest-dev/vitestJavaScriptChatGPT/CodexIncomplete remediationAuthentication & access control
GitPython validated configuration values but left section and option names unchecked. The repair rejects carriage returns, newlines and NUL characters in configuration names.
HighCVE-2026-67326May 6, 2026gitpython-developers/gitpythonPythonChatGPT/CodexFlawed AI-written codeValidation & fail-open logic
AI-written code returned early on an auto-allow sandbox result, skipping path-constraint checks and letting path traversal commands read outside the sandbox.
CVE-2026-35570Apr 21, 2026gitlawb/openclaudeTypeScriptChatGPT/CodexDirect introductionAuthentication & access control
AI-written code interpolated an untrusted issue title into a bash script, enabling command injection and exfiltration via GitHub Actions.
GHSA-F67F-HCR6-94MFMar 20, 2026shadd0wtaka/zen-ai-pentestPythonChatGPT/CodexDirect introductionInjection & unsafe execution
An AI-assisted change added authentication for plugin channel routes but checked the raw request path, so encoded or case-varied spellings of the same route skipped it.
CVE-2026-32031Mar 19, 2026openclaw/openclawTypeScriptChatGPT/CodexFlawed AI-written codeAuthentication & access control
An AI-assisted change added an OAuth consent form that wrote the client name, client id, redirect URI, state and error text into HTML through Python f-strings, so a registration an attacker controls could run script in the browser of the operator who opens the page.
CVE-2026-32112Mar 12, 2026homeassistant-ai/ha-mcpPythonChatGPT/CodexDirect introductionSSRF & network boundaries