EUVD-2026-39012Severity by source
AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Trigger arrives via local terminal output (AV:L), depends on the non-default wslview-failure fallback (AC:H), needs a victim click (UI:R), and command execution crosses WSL into the Windows host (S:C, C/I/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Warp is an agentic development environment. From 0.2024.03.12.08.02.stable_01 until 0.2026.05.06.15.42.stable_01, Warp contains an OS command injection vulnerability in the WSL URL-opening fallback. When Warp is running under WSL and cannot open a URL through wslview, it falls back to a Windows command processor path. A URL controlled through terminal output can reach that fallback when the user opens the link. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
AnalysisAI
OS command injection in Warp (the agentic terminal/development environment) affects builds from 0.2024.03.12.08.02.stable_01 up to the fix in 0.2026.05.06.15.42.stable_01 when running under Windows Subsystem for Linux. When wslview cannot open a URL, Warp falls back to a Windows command processor (cmd.exe /c start), so a malicious URL emitted into terminal output executes attacker-controlled Windows commands once the user clicks the link. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following concrete conditions: (1) Warp must be running under Windows Subsystem for Linux; (2) the wslview URL-opening path must fail or be unavailable so Warp reaches the cmd.exe /c start fallback; (3) a crafted URL must be present in the Warp terminal output (deliverable by any process or remote content whose output is displayed); and (4) the user must actively click/open that link (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 7.7 High) tells a consistent story: local attack vector because the trigger arrives through terminal output rather than directly over the network, high attack complexity because exploitation depends on the WSL deployment mode and on wslview failing so the cmd.exe fallback is reached, no privileges required, but mandatory user interaction (the victim must click the link). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker lures a Warp-on-WSL user into running a command or viewing remote content (e.g. a README, log, or git output) that prints a crafted URL containing Windows command metacharacters. … |
| Remediation | Vendor-released patch: 0.2026.05.06.15.42.stable_01 - upgrade Warp to this version or later, which validates that URLs parse and use only the http/https scheme and switches the WSL fallback from cmd.exe /c start to rundll32.exe url.dll,FileProtocolHandler with a re-serialized, percent-encoded URL. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Warp installations on WSL systems and determine which are running vulnerable versions (0.2024.03.12.08.02.stable_01 through pre-0.2026.05.06.15.42.stable_01). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint'
Command injection in Warp's legacy SSH background command path lets an attacker-controlled remote host inject shell synt
Arbitrary code execution in the Warp agentic development environment (builds 0.2023.10.24.08.03.stable_00 through 0.2026
Arbitrary local file write in Warp terminal (0.2025.03.05.08.02.stable_00 through builds before 0.2026.05.06.15.42.stabl
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" f
Command-execution permission bypass in Warp's default unsandboxed CLI agent profile (versions 0.2025.10.08.08.12.stable_
Command injection in Warp's prompt branch-selector chip lets a crafted Git branch name execute in the victim's shell whe
Clipboard hijacking in the Warp agentic terminal (versions 0.2021.04.25.23.05.stable_00 through 0.2026.05.06.15.42.stabl
Command injection in the Warp agentic development environment (Linux builds 0.2024.02.20.08.01.stable_01 through pre-0.2
OS command injection in Warp's AI Agent code-search tooling allows attacker-controlled inputs to escape read-only search
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WA
An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today