EUVD-2026-39013Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Network-delivered spoofing via PTY requires no authentication or elevated complexity; impact is integrity only (falsified UI metadata), not confidentiality or availability.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepted certain state-mutating terminal lifecycle hooks from the PTY stream without verifying that the hooks were emitted by Warp's shell integration for the active session. An attacker who could cause a victim to view attacker-controlled terminal output in Warp could spoof selected lifecycle metadata, including the current working directory reported for the active block or SSH session transport metadata. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
AnalysisAI
Terminal lifecycle hook spoofing in Warp versions prior to 0.2026.05.06.15.42.stable_01 allows an attacker who controls terminal output viewed by a victim to inject unauthenticated shell integration hooks into the PTY stream, causing Warp to accept falsified session metadata - including spoofed current working directory and SSH session transport parameters. Exploitation requires user interaction (the victim must view attacker-controlled terminal content in Warp), and no public exploit code has been identified at time of analysis. The CVSS-assigned availability impact (A:L) and absence of integrity impact (I:N) appear inconsistent with the described spoofing behavior; session state falsification is the primary operational concern for affected users.
Technical ContextAI
Warp's shell integration injects bash/zsh scripts that emit structured JSON lifecycle hooks through the PTY stream using OSC escape sequences (e.g., \e]9278;...). These hooks inform the Warp UI of state changes: current working directory, command start/finish (Preexec, CommandFinished), SSH session parameters (SSH, PreInteractiveSSHSession), input buffer state, and display updates (Clear, FinishUpdate). Prior to the fix, Warp accepted these hooks from any content appearing in the PTY stream without verifying the message originated from the legitimate shell integration bound to the active session - attacker-controlled output could emit hooks that Warp would process as authoritative. The patch, visible in commits 32d21d15 and 51bd3267, adds a session_id field to every hook type and validates it against the active session. A secondary flaw is also fixed: SSH session IDs were previously generated from date +%s combined with $RANDOM - a predictable seed - replaced by a cryptographically random 8-byte value from /dev/urandom. The CPE cpe:2.3:a:warpdotdev:warp:*:*:*:*:*:*:*:* covers the full affected range. The NVD CWE-78 (OS Command Injection) label appears to be a mislabeling; the root cause more closely corresponds to CWE-345 (Insufficient Verification of Data Authenticity), as Warp failed to authenticate the origin of hook messages before acting on them.
RemediationAI
Upgrade to Warp version 0.2026.05.06.15.42.stable_01 or later, which is the vendor-released patch confirmed by the GitHub security advisory at https://github.com/warpdotdev/warp/security/advisories/GHSA-9w2v-jhww-vm85 and corroborated by commits 32d21d15c9a3da1a923d1ed66226cf5cba081d16 and 51bd3267803c5cc0a45074fa19fd50162be7c917. If immediate upgrade is not possible, users should avoid SSHing into untrusted remote servers using Warp with shell integration active and should not cat, view, or execute content from untrusted sources within a Warp session, as these are the primary delivery mechanisms for injected hooks. Disabling Warp shell integration entirely would eliminate the attack surface but also removes CWD tracking, command timing, and other core Warp features - this trade-off is significant and the upgrade path is strongly preferred. No network-level controls can block this vulnerability as the injection occurs within a legitimate PTY stream.
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint'
Command injection in Warp's legacy SSH background command path lets an attacker-controlled remote host inject shell synt
Arbitrary code execution in the Warp agentic development environment (builds 0.2023.10.24.08.03.stable_00 through 0.2026
Arbitrary local file write in Warp terminal (0.2025.03.05.08.02.stable_00 through builds before 0.2026.05.06.15.42.stabl
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" f
Command-execution permission bypass in Warp's default unsandboxed CLI agent profile (versions 0.2025.10.08.08.12.stable_
Command injection in Warp's prompt branch-selector chip lets a crafted Git branch name execute in the victim's shell whe
Clipboard hijacking in the Warp agentic terminal (versions 0.2021.04.25.23.05.stable_00 through 0.2026.05.06.15.42.stabl
Command injection in the Warp agentic development environment (Linux builds 0.2024.02.20.08.01.stable_01 through pre-0.2
OS command injection in Warp's AI Agent code-search tooling allows attacker-controlled inputs to escape read-only search
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WA
An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today