What’s Vulnerable › Products

warpdotdev warp vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your warpdotdev warp version is affected

Latest warpdotdev warp vulnerabilities

• CVE-2026-54699 — Warp: OS command injection when opening terminal links from WSL (CVSS 7.7)
• CVE-2026-54686 — Warp: DCS lifecycle hook spoofing can alter terminal session metadata (CVSS 4.3)
• CVE-2026-48732 — Warp: Remote SSH cwd can lead to unauthorized remote command execution (CVSS 8.8)
• CVE-2026-48731 — Warp: Linux external editor command injection (CVSS 7.8)
• CVE-2026-48725 — Warp may allow terminal output to access the local clipboard through OSC 52 (CVSS 8.1)
• CVE-2026-48721 — Warp: Env-var prefixes can lead to denylisted command autoexecution (CVSS 8.6)
• CVE-2026-48720 — Warp: SSH remote output can lead to local file overwrite and persistence (CVSS 8.8)
• CVE-2026-48719 — Warp branch selector command injection via Git branch names (CVSS 8.0)
• CVE-2026-48704 — Warp Markdown notebook links may open executable local files (CVSS 8.8)
• CVE-2026-48703 — Warp: Command Injection via Warp code search tool arguments (CVSS 7.8)