What is the CVSS score of CVE-2026-48732?

CVE-2026-48732 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Warp are affected by CVE-2026-48732?

Warp SSH terminal users face command injection attacks when connecting to attacker-controlled servers, enabling unauthorized command execution under their authenticated credentials with CVSS 8.8…. A patch is available.

How to fix or mitigate CVE-2026-48732?

Within 24 hours: Identify all Warp SSH users in the organization and alert them to connect only to trusted SSH servers. Within 7 days: Deploy Warp version 0.2026.05.06.15.42.stable_01 or later to all systems using your standard software update procedures. Within 30 days: Verify 100% update completion across all endpoints and review SSH access logs for exploitation indicators.

Warp CVE-2026-48732

EUVD-2026-39014 HIGH

OS Command Injection (CWE-78)

2026-06-24 GitHub_M

Command Injection Warp

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable and low-complexity with no attacker privileges, but the victim must connect an SSH session (UI:R); injected commands run with full read/write/destructive capability as the victim's remote account.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 24, 2026 - 19:17 EUVD

Source Code Evidence Fetched

Jun 24, 2026 - 18:18 vuln.today

Analysis Generated

Jun 24, 2026 - 18:18 vuln.today

DescriptionCVE.org

Warp is an agentic development environment. From 0.2023.03.21.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection issue in the legacy SSH background command path. Warp used the remote working directory reported by the session when building helper commands for SSH-backed metadata collection. A remote host, repository, or directory name controlled by an attacker could cause that helper command to execute additional shell syntax on the remote host as the victim's authenticated SSH account. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.

AnalysisAI

Command injection in Warp's legacy SSH background command path lets an attacker-controlled remote host inject shell syntax that runs as the victim's authenticated SSH account. Affecting Warp from 0.2023.03.21.08.02.stable_00 up to (but not including) 0.2026.05.06.15.42.stable_01, the flaw stems from the terminal trusting the remote working directory, repository, or directory name reported by an SSH session when assembling helper commands for metadata collection. No public exploit identified at time of analysis, though the fix commit ships regression tests that demonstrate the breakout; not listed in CISA KEV and no EPSS provided.

Technical ContextAI

Warp is an agentic, Rust-based terminal/development environment. The bug lives in its remote command executor (app/src/terminal/model/session/command_executor/remote_command_executor.rs) and history reader (session.rs), which build helper shell commands such as cd '{current_directory_path}' && ... and cat {history_file} for SSH-backed metadata collection. Because the working-directory/history-file path was interpolated into a single-quoted shell string without escaping, an embedded single quote closes the quote and lets following characters be parsed as shell syntax - the classic CWE-78 OS Command Injection root cause. The fix introduces shell_escape_single_quotes() (shell-aware for Bash, Zsh, Fish, PowerShell) so embedded quotes are neutralized as literal text. Per CPE cpe:2.3:a:warpdotdev:warp:*, all platform builds of the Warp app in the affected range are in scope.

RemediationAI

Vendor-released patch: 0.2026.05.06.15.42.stable_01 - upgrade Warp to this version or later, which adds shell-aware single-quote escaping (shell_escape_single_quotes) around remote paths. There is no documented in-product configuration flag to fully disable the legacy SSH metadata-collection path, so the upgrade is the authoritative fix; as interim compensating controls, avoid using Warp's SSH integration to connect to untrusted or attacker-influenced hosts and avoid navigating into or cloning repositories with unusual directory names (e.g. containing single quotes or shell metacharacters) during SSH sessions, accepting the trade-off that this curtails normal remote-workflow convenience. Review the advisory (https://github.com/warpdotdev/warp/security/advisories/GHSA-qqpc-wvvw-4269) and commit (https://github.com/warpdotdev/warp/commit/88c344e2de662a935f0ef0896458494ef2413add) for exact behavior; do not rely on directory-name hygiene as a durable control since enforcement is hard to guarantee on remote hosts.