Warp CVE-2026-48704

Exploitation requires that (1) the victim is running an affected Warp build between 0.2023.10.24.08.03.stable_00 and 0.2026.05.06.15.42.stable_01, (2) the victim opens an attacker-controlled Markdown document or project in Warp's notebook viewer, (3) an executable file (e.g. an extensionless shell script classified as binary by is_file_openable_in_warp) exists at the path the malicious local-file link resolves to, and (4) the victim actively clicks that link (CVSS UI:R). Exploitation is limited by this mandatory user interaction and by the need for the executable payload to be present locally at the resolved path; it does not work against image targets (routed safely to the system viewer) or against files that resolve to Warp's MarkdownViewer/CodeEditor/ExternalEditor targets. No special privileges or authentication are required (PR:N), and the flaw affects default configurations of vulnerable builds.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high impact with the single mitigating factor of required user interaction - the victim must open the malicious Markdown and click the crafted link. There is no CISA KEV entry and no EPSS score provided, and no public proof-of-concept is referenced, so this is best treated as a high-severity-but-not-yet-actively-exploited issue rather than a fire-drill. The realistic risk is meaningfully gated by social engineering: the attacker depends on a developer trusting and clicking a link inside a shared Markdown/project, and on an executable being present at the resolved path. That said, agentic dev environments routinely open untrusted repositories and AI-generated content, which raises the plausibility of the click. Two caveats worth verifying: the CVSS vector lists PR:N/UI:R consistent with the description, but the attack also implicitly requires that a malicious executable file be reachable on the local filesystem at the linked path (e.g. delivered within the cloned project), which is not separately scored; and the tag 'Information Disclosure' understates the actual code-execution impact evidenced by the commit's regression tests.

An attacker publishes a repository (or sends a Markdown file) containing a link that looks like documentation but resolves to an extensionless shell script bundled in the project. A developer opens the project in Warp, reads the rendered Markdown, and clicks the link; on a vulnerable build Warp passes the file to the OS default opener, executing the attacker's code in the developer's context. No public POC is referenced, but the attack is low-complexity once the victim clicks (CVSS AC:L, UI:R).