EUVD-2026-39017Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Hostile terminal output is delivered remotely (AV:N) with no auth (PR:N) but requires the victim to render it (UI:R); overwriting a shell rc file yields code execution, so C/I/A are all High.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepts non-inline OSC 1337;File payloads from terminal output and materialize the decoded payload as a local file without an additional confirmation step. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
AnalysisAI
Arbitrary local file write in Warp terminal (0.2025.03.05.08.02.stable_00 through builds before 0.2026.05.06.15.42.stable_01) lets malicious terminal output silently drop attacker-controlled files onto disk. Warp honored non-inline OSC 1337;File (and multipart MultipartFile) iTerm2 escape sequences by base64-decoding the payload and writing it to the active block's current working directory using the attacker-supplied filename, with no confirmation prompt. Because shell startup files such as .zshenv can be overwritten this way, the write converts into code execution on the victim's host; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Technical ContextAI
Warp is an agentic, Rust-based terminal/development environment (cpe:2.3:a:warpdotdev:warp). The flaw lives in the terminal emulation layer's ANSI handler (app/src/terminal/model/terminal_model.rs), which implements iTerm2's proprietary OSC 1337 file-transfer protocol. That protocol carries a base64 'name' and base64 payload, with an 'inline' flag distinguishing images meant to render in-line from files meant to be saved to disk. The vulnerable handler treated non-inline payloads (inline=0) - delivered either as a single File OSC or as a chunked MultipartFile/FilePart/FileEnd sequence - as a request to call save_as_file() into the block's current_working_directory(). Because any program writing to the terminal (a remote SSH session, a curl'd log, a malicious repo's output, cat of a hostile file) can emit these escape sequences, untrusted output becomes an unauthenticated file-write primitive. The root cause maps to CWE-20 (Improper Input Validation): the emulator trusted a control sequence that should never have materialized files without user consent.
RemediationAI
Upgrade to the fixed build: Vendor-released patch: 0.2026.05.06.15.42.stable_01 (or any later stable release). The fix, in commit f3b9ce1c8fd13d037526c447418d809087722daa, removes the save_as_file() call entirely and replaces it with a log warning, so non-inline iTerm file payloads are now ignored while inline images still render. Review the advisory at https://github.com/warpdotdev/warp/security/advisories/GHSA-5h96-jrrq-6hxq. If you cannot update immediately, the practical compensating control is to avoid rendering untrusted output in Warp: do not cat, less, tail, or curl attacker-controlled files/streams and be cautious with remote SSH sessions or program output you do not trust, since any of these can emit the OSC 1337;File sequence - the trade-off is reduced day-to-day convenience and it does not fully close the gap. After patching or as a detection measure, audit shell startup files (~/.zshenv, ~/.zshrc, ~/.bashrc, ~/.profile) and recent session working directories for unexpected modifications, since a successful pre-patch attack would persist there.
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint'
Command injection in Warp's legacy SSH background command path lets an attacker-controlled remote host inject shell synt
Arbitrary code execution in the Warp agentic development environment (builds 0.2023.10.24.08.03.stable_00 through 0.2026
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" f
Command-execution permission bypass in Warp's default unsandboxed CLI agent profile (versions 0.2025.10.08.08.12.stable_
Command injection in Warp's prompt branch-selector chip lets a crafted Git branch name execute in the victim's shell whe
Clipboard hijacking in the Warp agentic terminal (versions 0.2021.04.25.23.05.stable_00 through 0.2026.05.06.15.42.stabl
Command injection in the Warp agentic development environment (Linux builds 0.2024.02.20.08.01.stable_01 through pre-0.2
OS command injection in Warp's AI Agent code-search tooling allows attacker-controlled inputs to escape read-only search
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WA
An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for
By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to b
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today