EUVD-2026-39015Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local attacker-controlled file path (AV:L) with no prior privileges (PR:N) but mandatory victim action of opening the file (UI:R) yields code execution as the user, so C/I/A all High.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Warp is an agentic development environment. From 0.2024.02.20.08.01.stable_01 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection issue in the Linux external editor launcher. Warp expanded freedesktop .desktop Exec templates for affected editor integrations and executed the expanded command through a shell. A user who opens an attacker-controlled local file path through an affected external editor or system-default editor route can cause shell syntax embedded in that path to execute as the local user. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
AnalysisAI
Command injection in the Warp agentic development environment (Linux builds 0.2024.02.20.08.01.stable_01 through pre-0.2026.05.06.15.42.stable_01) lets an attacker run arbitrary shell commands as the local user when a victim opens a maliciously named file through an affected external or system-default editor route. Warp expanded freedesktop .desktop Exec templates and passed the result to a shell, so shell metacharacters embedded in a file path are interpreted rather than treated as data. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; impact is high (CVSS 7.8) but requires local context and user interaction.
Technical ContextAI
The flaw lives in Warp's Linux external editor launcher (app/src/util/file/external_editor/linux.rs). Freedesktop Desktop Entry files (.desktop) carry an Exec key with field codes such as %f/%u that should be substituted with file arguments and then executed as a tokenized argv. The vulnerable implementation instead string-substituted field codes and ran the assembled command via a shell (sh -c), so any shell syntax surviving into a file path was evaluated. This is a classic CWE-78 OS Command Injection caused by constructing a shell command line from untrusted input instead of executing the target program directly with a controlled argument vector. The fix (commit 861dacea) adds a spec-compliant tokenizer that parses quoting rules and expands field codes into discrete argv tokens, then executes the program directly without a shell, eliminating the shell-interpretation step. Affected product per CPE is cpe:2.3:a:warpdotdev:warp.
RemediationAI
Vendor-released patch: 0.2026.05.06.15.42.stable_01 - upgrade Warp on Linux to this release or later, which replaces shell-based Exec expansion with a spec-compliant tokenizer that runs the editor binary directly without a shell. Reference the advisory at https://github.com/warpdotdev/warp/security/advisories/GHSA-7xgc-mhc8-g7wc and the fix commit https://github.com/warpdotdev/warp/commit/861dacea2683f2fe263c3c3a1381c3cbb2b66809. Until patched, avoid opening files via the external editor or system-default editor route in Warp for any file whose name or path you did not create, and do not open files from untrusted archives, repositories, or shared directories where an attacker could control the path string (the trade-off is loss of the convenient editor-launch workflow). Where possible, configure a single trusted editor integration and treat unexpected file paths containing shell metacharacters (backticks, $(), ;, |, &) as suspect; this reduces but does not eliminate exposure, so prompt upgrade remains the only complete fix.
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint'
Command injection in Warp's legacy SSH background command path lets an attacker-controlled remote host inject shell synt
Arbitrary code execution in the Warp agentic development environment (builds 0.2023.10.24.08.03.stable_00 through 0.2026
Arbitrary local file write in Warp terminal (0.2025.03.05.08.02.stable_00 through builds before 0.2026.05.06.15.42.stabl
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" f
Command-execution permission bypass in Warp's default unsandboxed CLI agent profile (versions 0.2025.10.08.08.12.stable_
Command injection in Warp's prompt branch-selector chip lets a crafted Git branch name execute in the victim's shell whe
Clipboard hijacking in the Warp agentic terminal (versions 0.2021.04.25.23.05.stable_00 through 0.2026.05.06.15.42.stabl
OS command injection in Warp's AI Agent code-search tooling allows attacker-controlled inputs to escape read-only search
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WA
An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for
By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to b
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today