Warp CVE-2026-48719

Exploitation requires (1) the attacker to be able to publish a branch to a Git repository the victim opens in Warp - i.e. write/push access to a shared or forked remote; (2) the victim running an affected Warp version (0.2025.08.06.08.12.stable_00 through pre-0.2026.05.06.15.42.stable_01); and (3) the victim actively selecting the malicious branch from the prompt branch-selector chip in the UI (UI:R) - the payload does not fire automatically on clone/pull. Limiting factors: the mandatory victim click, the need for the victim to have the repo opened in Warp, and the attacker first obtaining branch-publishing access to a repo the victim trusts enough to open.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) reflects high confidentiality, integrity, and availability impact since injected commands run with the victim user's privileges. The two genuine brakes on real-world risk are UI:R (the victim must actively select the malicious branch from the chip UI) and the prerequisite that the attacker can publish a branch to a repo the victim opens - meaningful but not exotic in shared/forked repository workflows. No EPSS score was provided, the CVE is not in CISA KEV, and no public PoC was supplied, so there is no signal of active exploitation; this reads as a real but not emergency priority - a credible social-engineering/supply-chain vector rather than mass-exploited. One nuance to verify: CVSS marks AV:N, but the actual execution trigger is local user interaction inside the desktop app after pulling attacker content, so the 'network' rating reflects how the malicious branch is delivered, not remote unauthenticated execution.

An attacker with push access to a shared or forked Git repository creates a branch whose name embeds shell metacharacters (e.g. a command substitution payload). When a victim opens that repository in an affected Warp version and clicks the branch in the prompt's branch-selector chip, Warp formats the branch name into a checkout command and the shell executes the attacker's embedded command with the victim's privileges. No public PoC was provided, but the low attack complexity (AC:L) makes the payload straightforward once the victim is induced to select the branch.