EUVD-2026-39016Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPlant injection in untrusted content agent reads
-
DeliveryAgent emits denylisted command with env-var prefix
-
ExploitDenylist matched before canonicalization, no match
-
ExecutionCommand auto-executes without confirmation
-
ImpactArbitrary command execution on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Leading special element handling
|
| Exploitation Conditions | Requires the victim to be running Warp's default unsandboxed, non-interactive CLI agent profile (the one that relies on the command denylist and auto-executes non-denylisted commands), and requires the attacker to be able to influence the command string the agent outputs - typically via indirect prompt injection through untrusted content the agent processes. Exploitation is limited by these factors: the agent must actually be in the auto-executing CLI profile (modes that always prompt for confirmation are not bypassed the same way), a user must have invoked the agent (UI:R), and the installed version must fall between 0.2025.10.08.08.12.stable_00 and the 0.2026.05.06.15.42.stable_01 fix. No prior authentication or host privileges are needed (PR:N) - only control over the agent's emitted command. |
| Impact | CVSS 3.1 is 8.6 (High) with vector AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - local vector, low complexity, no privileges, user interaction required, and a scope change reflecting the broken trust boundary between the AI agent and the host, with full confidentiality/integrity/availability impact. The realistic trigger is indirect prompt injection: the attacker needs no host account, only the ability to influence what command the agent emits (untrusted repo content, files, or tool output the agent processes), which supports PR:N despite AV:L. The bypass is trivial and deterministic (one env-var prefix), so weaponization difficulty is low; however there is no KEV listing, no EPSS value in the provided data, and no POC, indicating targeted/theoretical rather than mass-scale exploitation today. Net: a genuine high priority for teams running Warp's auto-executing CLI agent on untrusted inputs, but the local vector and the requirement to influence agent output cap broad spray-and-pray risk. EPSS was not supplied and should be checked for final prioritization. |
| Exploit ScenarioDerived | An attacker plants a crafted instruction or file in a repository the developer asks Warp's CLI agent to operate on; through prompt injection the agent emits 'X=1 rm -rf ~/project', which should require confirmation under the 'rm' denylist. Because the env-var prefix defeats the pre-canonicalization string match, the agent auto-executes the destructive command on the developer's host without prompting. No public exploit code is identified, but the technique is a one-line env-var prefix and low-complexity to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 24, 2026
Command-execution permission bypass in Warp's default unsandboxed CLI agent profile (versions 0.2025.10.08.08.12.stable_00 through the fix in 0.2026.05.06.15.42.stable_01) lets denylisted, confirmation-required commands auto-execute. Because the non-interactive CLI agent matched command strings against its denylist before stripping leading environment-variable assignments, an attacker able to influence the agent's emitted command output (e.g., via prompt injection) can prefix a blocked command such as 'rm' with 'X=1' to evade the safety boundary. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: 0.2026.05.06.15.42.stable_01 - upgrade Warp to this version or later, which canonicalizes leading environment-variable assignments before denylist evaluation (advisory GHSA-3839-h8jj-ph82, commit 0c1e243292c642d9a7748f80813b6fdfc0b31a9e). Until patched, avoid running the non-interactive/auto-executing CLI agent profile against untrusted input; switch the agent to an interactive/manual-approval mode so denylisted commands prompt for confirmation (trade-off: loses unattended automation), and/or run the agent inside a sandbox or disposable container with no access to sensitive files or credentials (trade-off: setup overhead). Treat any repository content, files, or tool output the agent reads as attacker-controllable and restrict the agent's working environment accordingly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Warp is an agentic terminal/development environment whose CLI agent profile runs non-interactively and uses a command denylist (regex predicates such as 'rm .*') as its safety boundary, auto-executing anything not denylisted. The flaw is CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize): in app/src/ai/blocklist/permissions.rs the raw command string was tested against denylist predicates without first normalizing shell syntax. A POSIX shell treats leading 'VAR=value' tokens as environment assignments for the following command, so 'X=1 rm file.txt' still runs 'rm', yet the literal string fails to match the 'rm .*' anchor. The fix adds command_without_leading_env_vars() in crates/warp_completer and routes commands through command_for_execution_predicates() before denylist matching. Per CPE cpe:2.3:a:warpdotdev:warp, only the Warp application is affected.
Know when Warp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Local agent execution context (AV:L), trivial env-var prefix (AC:L), no host privileges since the trigger is agent-output influence (PR:N), user must run the agent (UI:R), and the broken agent-to-host boundary yields scope change with full host impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety boundary for commands that should require confirmation. Because command strings were checked before canonicalizing leading environment-variable assignments, an attacker who can influence the agent's command output may cause denylisted commands to be treated as non-denylisted. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
Executive ViewAI
Warp's CLI agent contains a vulnerability that bypasses its built-in safety controls, allowing execution of blocked commands in development environments. All developers using affected Warp versions are at risk, with potential impact to development workflows and CI/CD pipeline integrity. A patch is available and should be deployed to all development systems within 7 days.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint'
Command injection in Warp's legacy SSH background command path lets an attacker-controlled remote host inject shell synt
Arbitrary code execution in the Warp agentic development environment (builds 0.2023.10.24.08.03.stable_00 through 0.2026
Arbitrary local file write in Warp terminal (0.2025.03.05.08.02.stable_00 through builds before 0.2026.05.06.15.42.stabl
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" f
Command injection in Warp's prompt branch-selector chip lets a crafted Git branch name execute in the victim's shell whe
Clipboard hijacking in the Warp agentic terminal (versions 0.2021.04.25.23.05.stable_00 through 0.2026.05.06.15.42.stabl
Command injection in the Warp agentic development environment (Linux builds 0.2024.02.20.08.01.stable_01 through pre-0.2
OS command injection in Warp's AI Agent code-search tooling allows attacker-controlled inputs to escape read-only search
Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WA
An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for
By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to b
Exploit-DB