EUVD-2026-39015Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft file path with embedded shell syntax
-
DeliveryDeliver file to victim (repo/archive/share)
-
ExploitVictim opens it via Warp external editor
-
ExecutionExec template expanded and passed to shell
-
PersistEmbedded syntax executes as local user
-
ImpactFull code execution at user privilege
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Warp external editor launcher on Linux to expand a freedesktop .desktop Exec template for an affected editor integration or the system-default editor route, and the victim must actively open an attacker-controlled local file path whose name/path contains shell metacharacters (UI:R). Limiting factors: exploitation is local only (AV:L) - the attacker must first get the malicious file path onto the victim's system and induce them to open it through the editor route; it does not work against versions outside 0.2024.02.20.08.01.stable_01-pre-0.2026.05.06.15.42.stable_01, is specific to Linux, and does not trigger automatically without the user opening the file. No elevated privileges are needed (PR:N); code runs at the victim's own privilege level. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High) is internally consistent with the description: exploitation is local (the attacker must get a crafted file path in front of the victim), low complexity, needs no prior privileges, but requires the victim to actively open the file (UI:R), yielding full confidentiality/integrity/availability impact as the local user. No EPSS score and no KEV listing were provided, and no exploit code was supplied - only the upstream fix commit - so real-world exploitation probability appears low and opportunistic rather than mass-automatable. SSVC-style reading: exploitation = none observed, automatable = no (requires per-victim social engineering / file delivery), technical impact = total. Net: a legitimately high-impact local code-execution bug, but the local vector plus required user interaction make it a moderate operational priority rather than an emergency, absent evidence of active exploitation. No conflicting signals were found in the supplied data; EPSS and POC status are simply absent. |
| Exploit ScenarioDerived | An attacker delivers a repository, archive, or shared folder containing a file whose name embeds shell syntax (for example a backtick or $() sequence). When the victim opens that file in Warp via an affected external/system-default editor on Linux, Warp expands it into a shell command line and the embedded syntax executes as the victim's user. No public POC was provided, but the local, low-complexity vector means a single user-interaction (opening the file) is sufficient to achieve code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 24, 2026
Command injection in the Warp agentic development environment (Linux builds 0.2024.02.20.08.01.stable_01 through pre-0.2026.05.06.15.42.stable_01) lets an attacker run arbitrary shell commands as the local user when a victim opens a maliciously named file through an affected external or system-default editor route. Warp expanded freedesktop .desktop Exec templates and passed the result to a shell, so shell metacharacters embedded in a file path are interpreted rather than treated as data. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; impact is high (CVSS 7.8) but requires local context and user interaction.
RemediationAI
Vendor-released patch: 0.2026.05.06.15.42.stable_01 - upgrade Warp on Linux to this release or later, which replaces shell-based Exec expansion with a spec-compliant tokenizer that runs the editor binary directly without a shell. Reference the advisory at https://github.com/warpdotdev/warp/security/advisories/GHSA-7xgc-mhc8-g7wc and the fix commit https://github.com/warpdotdev/warp/commit/861dacea2683f2fe263c3c3a1381c3cbb2b66809. Until patched, avoid opening files via the external editor or system-default editor route in Warp for any file whose name or path you did not create, and do not open files from untrusted archives, repositories, or shared directories where an attacker could control the path string (the trade-off is loss of the convenient editor-launch workflow). Where possible, configure a single trusted editor integration and treat unexpected file paths containing shell metacharacters (backticks, $(), ;, |, &) as suspect; this reduces but does not eliminate exposure, so prompt upgrade remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Warp's Linux external editor launcher (app/src/util/file/external_editor/linux.rs). Freedesktop Desktop Entry files (.desktop) carry an Exec key with field codes such as %f/%u that should be substituted with file arguments and then executed as a tokenized argv. The vulnerable implementation instead string-substituted field codes and ran the assembled command via a shell (sh -c), so any shell syntax surviving into a file path was evaluated. This is a classic CWE-78 OS Command Injection caused by constructing a shell command line from untrusted input instead of executing the target program directly with a controlled argument vector. The fix (commit 861dacea) adds a spec-compliant tokenizer that parses quoting rules and expands field codes into discrete argv tokens, then executes the program directly without a shell, eliminating the shell-interpretation step. Affected product per CPE is cpe:2.3:a:warpdotdev:warp.
Know when Warp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local attacker-controlled file path (AV:L) with no prior privileges (PR:N) but mandatory victim action of opening the file (UI:R) yields code execution as the user, so C/I/A all High.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Warp is an agentic development environment. From 0.2024.02.20.08.01.stable_01 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection issue in the Linux external editor launcher. Warp expanded freedesktop .desktop Exec templates for affected editor integrations and executed the expanded command through a shell. A user who opens an attacker-controlled local file path through an affected external editor or system-default editor route can cause shell syntax embedded in that path to execute as the local user. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
Executive ViewAI
Warp agentic development environment (Linux) contains a high-severity command injection vulnerability (CVSS 7.8) that enables attackers to execute arbitrary code on developer machines if users open maliciously named files. This directly threatens code integrity, intellectual property security, and enterprise infrastructure given developers' typical access to production systems and repositories. Immediate assessment and mitigation planning are required.
No vendor-released patch identified at time of analysis. Interim mitigations: disable external editor and system-default editor routes in Warp configuration; restrict file naming conventions in development directories to exclude shell metacharacters; implement file integrity monitoring on developer workstations; conduct security awareness training emphasizing risks of opening files from untrusted sources; isolate development environments using containerization or sandboxing to limit command execution scope.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint'
Command injection in Warp's legacy SSH background command path lets an attacker-controlled remote host inject shell synt
Arbitrary code execution in the Warp agentic development environment (builds 0.2023.10.24.08.03.stable_00 through 0.2026
Arbitrary local file write in Warp terminal (0.2025.03.05.08.02.stable_00 through builds before 0.2026.05.06.15.42.stabl
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" f
Command-execution permission bypass in Warp's default unsandboxed CLI agent profile (versions 0.2025.10.08.08.12.stable_
Command injection in Warp's prompt branch-selector chip lets a crafted Git branch name execute in the victim's shell whe
Clipboard hijacking in the Warp agentic terminal (versions 0.2021.04.25.23.05.stable_00 through 0.2026.05.06.15.42.stabl
OS command injection in Warp's AI Agent code-search tooling allows attacker-controlled inputs to escape read-only search
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WA
An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for
By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to b
Exploit-DB