PT-2026-52035 · Warpdotdev · Warp

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-54699

Mitre

CVSS v3.1

7.7

Alta

Vetor base

AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Warp is an agentic development environment. From 0.2024.03.12.08.02.stable 01 until 0.2026.05.06.15.42.stable 01, Warp contains an OS command injection vulnerability in the WSL URL-opening fallback. When Warp is running under WSL and cannot open a URL through wslview, it falls back to a Windows command processor path. A URL controlled through terminal output can reach that fallback when the user opens the link. This vulnerability is fixed in 0.2026.05.06.15.42.stable 01.

Correção

Improper Encoding or Escaping of Output

OS Command Injection

Enumeração de Fraquezas

CWE-116

CWE-78

Identificadores relacionados

CVE-2026-54699

Produtos afetados

Warp

Referências · 3

• https://github.com/warpdotdev/warp/commit/c66cff48afba73bb1f26f82e5d524018bacb748e · Nota
• https://github.com/warpdotdev/warp/security/advisories/GHSA-xmw3-wj6r-48m4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-54699 · Nota de Segurança