What is the CVSS score of CVE-2026-48725?

CVE-2026-48725 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Warp are affected by CVE-2026-48725?

Warp terminal, used by development teams for remote system access, is vulnerable to silent credential theft through a clipboard hijacking flaw.

How to fix or mitigate CVE-2026-48725?

24 hours: Identify all systems running affected Warp terminal versions (0.2021.04.25.23.05.stable_00 through 0.2026.05.06.15.42.stable_01); restrict SSH access from untrusted networks; notify users and request credential rotation. 7 days: Rotate all potentially exposed credentials (SSH keys, API tokens, database passwords) that may have been in the clipboard while using affected terminals; enforce multi-factor authentication on critical systems. 30 days: Monitor Warp project releases for official patch; implement compensating controls (SSH key restrictions, terminal replacement, or Warp rebuild from public fix commit if needed).

Warp CVE-2026-48725

EUVD-2026-39010 HIGH

Incorrect Default Permissions (CWE-276)

2026-06-24 GitHub_M

Privilege Escalation Warp

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Triggered by remote output with no auth (AV:N/PR:N), low complexity, but the victim must render the output (UI:R); clipboard read leaks secrets (C:H) and clipboard write enables paste-injection (I:H), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 24, 2026 - 18:16 vuln.today

Analysis Generated

Jun 24, 2026 - 18:16 vuln.today

DescriptionCVE.org

Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.42.stable_01, Warp allows terminal output to request access to the local system clipboard. A malicious remote host, remote program, or other attacker-controlled terminal output source can trigger clipboard reads or writes without a separate confirmation step. This crosses the trust boundary between untrusted terminal output and the user's local desktop clipboard. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.

AnalysisAI

Clipboard hijacking in the Warp agentic terminal (versions 0.2021.04.25.23.05.stable_00 through 0.2026.05.06.15.42.stable_01) lets attacker-controlled terminal output read and write the host desktop clipboard via OSC 52 escape sequences with no confirmation prompt. Any malicious remote host, compromised program, or hostile output stream rendered in the terminal can silently exfiltrate clipboard contents (e.g. copied passwords or tokens) or plant attacker text for the user to later paste. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the fix commit is public; CVSS is 8.1 (High).

Technical ContextAI

OSC 52 is an ANSI/xterm Operating System Command escape sequence that terminals may honor to let the running program set (and, in some implementations, query) the system clipboard. The affected component is Warp's terminal rendering path (app/src/terminal/view.rs), which unconditionally forwarded OSC 52 writes to ctx.clipboard().write() and serviced OSC 52 read requests by piping the host clipboard back into the PTY. Per CWE-276 (Incorrect Default Permissions), the insecure default was that clipboard access was granted automatically to terminal output with no per-event consent and no policy gate. The CPE cpe:2.3:a:warpdotdev:warp:*:*:*:*:*:*:*:* covers all Warp versions in the affected range across the supported desktop platforms.

RemediationAI

Vendor-released patch: upgrade Warp to 0.2026.05.06.15.42.stable_01 or later, which adds a terminal.osc52_clipboard_access policy that defaults to 'deny' for all OSC 52 clipboard operations. After upgrading, verify the setting remains 'deny' unless you specifically need clipboard integration, in which case prefer 'write_only' (lets programs set but not read the clipboard) over 'read_write', since read access is what enables silent exfiltration of copied secrets. Because the control is settings-driven and synced to cloud, administrators can enforce 'deny' org-wide. On unpatched versions there is no in-product toggle, so the practical compensating controls are operational: avoid catting/rendering untrusted files, logs, or remote command output in Warp, treat SSH sessions to untrusted hosts as hostile output sources, and clear sensitive data from the clipboard before working in the terminal - each reduces exposure but none fully blocks OSC 52 on a pre-fix build. Authoritative references: advisory GHSA-wgqj-4c26-7c4g and commit b1a41d0b1aba9f40db1e5ceb695183452a894003.