EUVD-2026-39016Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Local agent execution context (AV:L), trivial env-var prefix (AC:L), no host privileges since the trigger is agent-output influence (PR:N), user must run the agent (UI:R), and the broken agent-to-host boundary yields scope change with full host impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety boundary for commands that should require confirmation. Because command strings were checked before canonicalizing leading environment-variable assignments, an attacker who can influence the agent's command output may cause denylisted commands to be treated as non-denylisted. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
AnalysisAI
Command-execution permission bypass in Warp's default unsandboxed CLI agent profile (versions 0.2025.10.08.08.12.stable_00 through the fix in 0.2026.05.06.15.42.stable_01) lets denylisted, confirmation-required commands auto-execute. Because the non-interactive CLI agent matched command strings against its denylist before stripping leading environment-variable assignments, an attacker able to influence the agent's emitted command output (e.g., via prompt injection) can prefix a blocked command such as 'rm' with 'X=1' to evade the safety boundary. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
Warp is an agentic terminal/development environment whose CLI agent profile runs non-interactively and uses a command denylist (regex predicates such as 'rm .*') as its safety boundary, auto-executing anything not denylisted. The flaw is CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize): in app/src/ai/blocklist/permissions.rs the raw command string was tested against denylist predicates without first normalizing shell syntax. A POSIX shell treats leading 'VAR=value' tokens as environment assignments for the following command, so 'X=1 rm file.txt' still runs 'rm', yet the literal string fails to match the 'rm .*' anchor. The fix adds command_without_leading_env_vars() in crates/warp_completer and routes commands through command_for_execution_predicates() before denylist matching. Per CPE cpe:2.3:a:warpdotdev:warp, only the Warp application is affected.
RemediationAI
Vendor-released patch: 0.2026.05.06.15.42.stable_01 - upgrade Warp to this version or later, which canonicalizes leading environment-variable assignments before denylist evaluation (advisory GHSA-3839-h8jj-ph82, commit 0c1e243292c642d9a7748f80813b6fdfc0b31a9e). Until patched, avoid running the non-interactive/auto-executing CLI agent profile against untrusted input; switch the agent to an interactive/manual-approval mode so denylisted commands prompt for confirmation (trade-off: loses unattended automation), and/or run the agent inside a sandbox or disposable container with no access to sensitive files or credentials (trade-off: setup overhead). Treat any repository content, files, or tool output the agent reads as attacker-controllable and restrict the agent's working environment accordingly.
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint'
Command injection in Warp's legacy SSH background command path lets an attacker-controlled remote host inject shell synt
Arbitrary code execution in the Warp agentic development environment (builds 0.2023.10.24.08.03.stable_00 through 0.2026
Arbitrary local file write in Warp terminal (0.2025.03.05.08.02.stable_00 through builds before 0.2026.05.06.15.42.stabl
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" f
Command injection in Warp's prompt branch-selector chip lets a crafted Git branch name execute in the victim's shell whe
Clipboard hijacking in the Warp agentic terminal (versions 0.2021.04.25.23.05.stable_00 through 0.2026.05.06.15.42.stabl
Command injection in the Warp agentic development environment (Linux builds 0.2024.02.20.08.01.stable_01 through pre-0.2
OS command injection in Warp's AI Agent code-search tooling allows attacker-controlled inputs to escape read-only search
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WA
An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for
By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to b
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today