Back to overview

CVE-2026-48732

HIGH
8.8
CVSS 3.1
Description
Warp is an agentic development environment. From 0.2023.03.21.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection issue in the legacy SSH background command path. Warp used the remote working directory reported by the session when building helper commands for SSH-backed metadata collection. A remote host, repository, or directory name controlled by an attacker could cause that helper command to execute additional shell syntax on the remote host as the victim's authenticated SSH account. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.

Metadata

CVE ID
CVE-2026-48732
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-22 19:10 UTC
Published
2026-06-24 17:29 UTC
Last updated
2026-06-24 17:58 UTC
Primary CWE
CWE-78
CWE-78: Improper Neutralization of Special Elements used in …
Vendor / Product
warpdotdev / warp
Sources
cve.org  ·  NVD

Severity & Metrics

8.8 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
warpdotdev warp — >= 0.2023.03.21.08.02.stable_00, < 0.2026.05.13.09.15.stable_01
Weakness (CWE)
CWESourceDescription
CWE-78 cna CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.8 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References (2)
Back to overview