CVE-2026-48721

Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety boundary for commands that should require confirmation. Because command strings were checked before canonicalizing leading environment-variable assignments, an attacker who can influence the agent's command output may cause denylisted commands to be treated as non-denylisted. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/warpdotdev/warp/commit/0c1e243292c642d9a7748f80813b6fdfc0b31a9e
https://github.com/warpdotdev/warp/security/advisories/GHSA-3839-h8jj-ph82

Configurations

No configuration.

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Warp es un entorno de desarrollo agéntico. Desde 0.2025.10.08.08.12.stable_00 hasta 0.2026.05.06.15.42.stable_01, Warp contiene un bypass de verificación de permisos de ejecución de comandos en el perfil de agente CLI predeterminado sin sandbox. El perfil CLI no es interactivo y se basa en una lista negra de comandos como límite de seguridad para los comandos que deberían requerir confirmación. Debido a que las cadenas de comandos se verificaban antes de canonicalizar las asignaciones de variables de entorno iniciales, un atacante que puede influir en la salida de comandos del agente puede hacer que los comandos en la lista negra sean tratados como no en la lista negra. Esta vulnerabilidad está corregida en 0.2026.05.06.15.42.stable_01.

Information

Published : 2026-06-24 18:17

Updated : 2026-10-25 22:10

NVD link : CVE-2026-48721

Mitre link : CVE-2026-48721

CVE.ORG link : CVE-2026-48721

JSON object : View

Products Affected

No product.

CWE

CWE-180

Incorrect Behavior Order: Validate Before Canonicalize

CWE-693

Protection Mechanism Failure

{"id": "CVE-2026-48721", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48721", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-25T17:06:00.971042Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "warpdotdev", "product": "warp", "versions": [{"status": "affected", "version": ">= 0.2025.10.08.08.12.stable_00, < 0.2026.05.13.09.15.stable_01"}]}]}], "published": "2026-06-24T18:17:18.283", "references": [{"url": "https://github.com/warpdotdev/warp/commit/0c1e243292c642d9a7748f80813b6fdfc0b31a9e", "source": "security-advisories@github.com"}, {"url": "https://github.com/warpdotdev/warp/security/advisories/GHSA-3839-h8jj-ph82", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-180"}, {"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety boundary for commands that should require confirmation. Because command strings were checked before canonicalizing leading environment-variable assignments, an attacker who can influence the agent's command output may cause denylisted commands to be treated as non-denylisted. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01."}, {"lang": "es", "value": "Warp es un entorno de desarrollo ag\u00e9ntico. Desde 0.2025.10.08.08.12.stable_00 hasta 0.2026.05.06.15.42.stable_01, Warp contiene un bypass de verificaci\u00f3n de permisos de ejecuci\u00f3n de comandos en el perfil de agente CLI predeterminado sin sandbox. El perfil CLI no es interactivo y se basa en una lista negra de comandos como l\u00edmite de seguridad para los comandos que deber\u00edan requerir confirmaci\u00f3n. Debido a que las cadenas de comandos se verificaban antes de canonicalizar las asignaciones de variables de entorno iniciales, un atacante que puede influir en la salida de comandos del agente puede hacer que los comandos en la lista negra sean tratados como no en la lista negra. Esta vulnerabilidad est\u00e1 corregida en 0.2026.05.06.15.42.stable_01."}], "lastModified": "2026-10-25T22:10:00.150", "sourceIdentifier": "security-advisories@github.com"}