Warp CVE-2026-48725

Exploitation requires that the victim render attacker-controlled terminal output inside a vulnerable Warp build (0.2021.04.25.23.05.stable_00 through pre-0.2026.05.06.15.42.stable_01) - the malicious source can be a remote host the user SSHes to, a remote program, or any output stream the terminal displays - and that output must contain OSC 52 clipboard escape sequences. The concrete prerequisite is OSC 52 handling being enabled by default with no confirmation gate, which is the pre-patch behavior; no authentication, no special privilege, and no non-default Warp configuration are needed. The limiting factor is user interaction: the malicious output must actually be displayed in the user's Warp terminal (UI:R), so a victim must view/run something that streams the sequence. For the write/paste-injection path to reach code execution, the additional human step of pasting the clipboard into a shell is required; the read path leaks data with no further user action. On patched builds the default 'deny' policy (terminal.osc52_clipboard_access) blocks the technique entirely.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (8.1 High) is internally consistent with the description: the trigger reaches the victim over the network (a remote host or remote program's output), requires no authentication or special privilege, and is low-complexity, but does require user interaction in the sense that the victim must render the malicious output in their Warp terminal. EPSS was not supplied in the input, so exploitation probability cannot be quantified here. There is no KEV listing and no POC referenced, so this is not confirmed actively exploited - the only public artifact is the vendor fix commit, meaning a determined researcher could reconstruct the technique. The realistic priority is moderate-to-high for developer workstations: confidentiality impact is genuine because secrets are frequently held on the clipboard, and the integrity impact (clipboard write / paste-injection) can escalate to command execution only if the user subsequently pastes attacker-controlled content into a shell - a second action not captured by the base score.

An attacker hosts a malicious server (or a trojaned CLI tool/log file) whose output embeds an OSC 52 read sequence; when a developer connects or views that output in a pre-fix Warp, the terminal silently returns the host clipboard into the stream, leaking any copied API key or password. Alternatively the output writes attacker-chosen text (e.g. a curl|sh one-liner) into the clipboard so the developer unknowingly pastes and runs it. No public POC is referenced, but the technique is straightforward given the public fix commit and the low-complexity, no-privilege CVSS profile.