Warp CVE-2026-48720

Exploitation requires that the victim is running a vulnerable Warp build (>= 0.2025.03.05.08.02.stable_00 and < 0.2026.05.06.15.42.stable_01) and that attacker-controlled bytes reach the terminal containing a non-inline OSC 1337;File or MultipartFile escape sequence (inline=0) - for example via cat/less of a hostile file, a remote SSH/program output stream, or a malicious repository's command output. Warp must have a known current working directory for the active block (the payload is written relative to it), and the filename in the payload determines what gets created or overwritten (e.g., .zshenv for execution-on-next-shell). Limiting factors: it is not zero-click - per CVSS UI:R the user must actually render or run the output carrying the sequence; no authentication to Warp is required (PR:N); and the file lands in the session's working directory, so leveraging it for code execution depends on writing to a path that is later read/executed (such as a shell rc file in that directory or the user's home).

The provided CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (base 8.8, High) is consistent with the mechanism: the trigger arrives over the network via terminal output (AV:N), requires no authentication to Warp itself (PR:N), is low-complexity (AC:L), but needs the victim to render the hostile output (UI:R). The triple-High impact is justified because overwriting .zshenv/.bashrc yields code execution and thus full confidentiality, integrity, and availability loss on the user's account. No SSVC, EPSS, KEV, or POC signals were supplied; the only exploitation artifact is the vendor's own fix commit and regression tests (which demonstrate the .zshenv overwrite-to-RCE pattern), so this is a credible, easy-to-weaponize issue rather than an inflated high-CVSS-but-low-real-risk finding. The realistic limiter is UI:R - the victim must actually run or view a command whose output an attacker controls - so this is high priority for anyone piping untrusted/remote content through Warp, but not a wormable, zero-click exploit. Caveat: AV:N is the standard rating for terminal-escape injection, but exploitation in practice depends on the user routing attacker-controlled bytes to their terminal, which sits between purely remote and local - defenders should weight that nuance.

An attacker hosts a file or controls a remote command's output containing a crafted OSC 1337;File=name=LnpzaGVudg==;inline=0:<base64 payload> sequence whose decoded payload is a malicious shell snippet and whose name is .zshenv. When the victim views or runs the command in a vulnerable Warp build (for example, cat'ing the file or reading a hostile SSH banner), Warp silently writes .zshenv into the session's working directory; the attacker's code then runs the next time a shell is started. No public exploit tool is identified, but the vendor's regression test demonstrates exactly this overwrite-to-execution path (touch /tmp/warp-pwned via .zshenv).