EUVD-2026-39002Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious content is delivered remotely (AV:N) with no auth (PR:N) but requires the victim to open and click a link (UI:R); resulting code execution yields full C/I/A impact in the user context.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Warp is an agentic development environment. From 0.2023.10.24.08.03.stable_00 until 0.2026.05.06.15.42.stable_01, Warp may open executable local files through the operating system default file handler. A malicious Markdown document or project can contain a local-file link that appears as normal rendered content. If a user opens the Markdown in Warp and clicks the link, affected builds may route the resolved local file to a platform file opener instead of limiting the action to safe viewer/editor targets. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
AnalysisAI
Arbitrary code execution in the Warp agentic development environment (builds 0.2023.10.24.08.03.stable_00 through 0.2026.05.06.15.42.stable_01) arises because the Markdown link handler routes resolved local-file links to the operating system's default file opener. A malicious Markdown document or project repository can embed a benign-looking local-file link that, when clicked, hands an executable (such as an extensionless shell script) to the platform file opener (e.g. NSWorkspace.openURL on macOS) instead of a safe viewer/editor, executing it. There is no public exploit identified at time of analysis, but the fix is confirmed in 0.2026.05.06.15.42.stable_01 and the root cause is documented in the upstream commit and GHSA advisory.
Technical ContextAI
Warp is a Rust-based terminal/agentic development environment that renders Markdown 'notebooks' with clickable links. The vulnerable logic lives in app/src/notebooks/link.rs (function open_file). For non-image local files the code called resolve_file_target() and, when the result was FileTarget::SystemGeneric or FileTarget::SystemDefault, emitted an OpenFileWithTarget event that ultimately delegated to the OS default handler. Files that are not recognized as text/markdown/code - notably extensionless binaries - are classified as binary by is_file_openable_in_warp and fell through to that system-default path, so the OS would execute them rather than display them. This is a classic CWE-20 (Improper Input Validation) trust failure: untrusted link targets in attacker-supplied content were not constrained to a safe set of viewer/editor sinks before being passed to a powerful OS primitive. The fix allow-lists only MarkdownViewer/CodeEditor/ExternalEditor/EnvEditor targets and reveals anything that would hit SystemGeneric/SystemDefault in Finder/Explorer (open_file_path_in_explorer) instead of opening it.
RemediationAI
Vendor-released patch: upgrade Warp to 0.2026.05.06.15.42.stable_01 or later, which routes any link target that would otherwise go to the OS default handler (FileTarget::SystemGeneric / SystemDefault) through reveal-in-Finder/Explorer instead of opening it, per GHSA-589x-4mxh-jcrf (https://github.com/warpdotdev/warp/security/advisories/GHSA-589x-4mxh-jcrf) and commit 7f0c4dd2322198f1b39890f8e6bcdc606c6a3c74. Until updated, the practical compensating control is behavioral: do not click local-file links inside Markdown documents or project files originating from untrusted sources, and avoid opening untrusted repositories in Warp's notebook viewer; the trade-off is reduced convenience navigating legitimate in-project links. As a defense-in-depth measure on managed endpoints, restrict execute permissions or use OS-level controls (e.g. Gatekeeper/quarantine on macOS, AppLocker on Windows) on directories where untrusted projects are cloned, accepting that this may interfere with legitimate developer tooling. There is no configuration toggle that disables the vulnerable path short of upgrading.
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint'
Command injection in Warp's legacy SSH background command path lets an attacker-controlled remote host inject shell synt
Arbitrary local file write in Warp terminal (0.2025.03.05.08.02.stable_00 through builds before 0.2026.05.06.15.42.stabl
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" f
Command-execution permission bypass in Warp's default unsandboxed CLI agent profile (versions 0.2025.10.08.08.12.stable_
Command injection in Warp's prompt branch-selector chip lets a crafted Git branch name execute in the victim's shell whe
Clipboard hijacking in the Warp agentic terminal (versions 0.2021.04.25.23.05.stable_00 through 0.2026.05.06.15.42.stabl
Command injection in the Warp agentic development environment (Linux builds 0.2024.02.20.08.01.stable_01 through pre-0.2
OS command injection in Warp's AI Agent code-search tooling allows attacker-controlled inputs to escape read-only search
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WA
An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for
By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to b
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today