Warp Terminal CVE-2026-54699

Exploitation requires all of the following concrete conditions: (1) Warp must be running under Windows Subsystem for Linux; (2) the wslview URL-opening path must fail or be unavailable so Warp reaches the cmd.exe /c start fallback; (3) a crafted URL must be present in the Warp terminal output (deliverable by any process or remote content whose output is displayed); and (4) the user must actively click/open that link (UI:R). Limiting factors that reduce real-world risk: it does not affect native Windows, macOS, or non-WSL Linux installs; it requires the non-default failure of wslview rather than the normal happy path (reflected in AC:H); and it depends on victim interaction, so it cannot be triggered silently or automatically.

The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 7.7 High) tells a consistent story: local attack vector because the trigger arrives through terminal output rather than directly over the network, high attack complexity because exploitation depends on the WSL deployment mode and on wslview failing so the cmd.exe fallback is reached, no privileges required, but mandatory user interaction (the victim must click the link). The scope change (S:C) is well justified - code crosses the WSL/Linux boundary to execute on the Windows host - and the full C:H/I:H/A:H reflects arbitrary command execution. Real-world priority is moderate rather than urgent: no EPSS score, KEV status, or POC was supplied, so there is no signal of active or automated exploitation, and AC:H plus UI:R meaningfully limit mass exploitation. This is a credible, high-impact bug for the specific population of Warp-on-WSL users, but the gating conditions make it more suited to targeted/social-engineering use than opportunistic mass exploitation. Note one tension to verify: the description and CVSS treat this as local (AV:L), yet the triggering URL can originate from remote content rendered into the terminal - defenders should treat the injected payload source as potentially remote even though Warp itself classifies the vector as local.

An attacker lures a Warp-on-WSL user into running a command or viewing remote content (e.g. a README, log, or git output) that prints a crafted URL containing Windows command metacharacters. When wslview is unavailable or fails and the victim clicks the link, Warp passes the URL to the Windows command processor, executing the attacker's commands on the Windows host. No public POC was provided, and the AC:H/UI:R profile means success depends on the WSL fallback being reachable and on the user clicking.