Executive brief
Warp is a modern terminal and development environment that uses AI agents to assist with coding tasks. A security flaw in its code search tools allows an attacker to trick the AI into running unauthorized commands on a user's computer. If a user interacts with malicious project files or content, the attacker could gain full control over the terminal session, potentially leading to data theft or system compromise.
Technical details
A command injection vulnerability (CWE-78) exists in the Warp Agent's Grep and FileGlob actions. While these actions are classified as read-only search operations, their implementation fails to properly neutralize special characters when building shell command strings from Agent-controlled inputs like search text, paths, and glob patterns. An attacker can exploit this by influencing the Agent's context—for example, through prompt injection in local project files—to execute arbitrary shell syntax in the active terminal session. This bypasses the standard command execution approval workflow. The issue is resolved in version 0.2026.05.06.15.42.stable_01 by properly quoting search arguments and patterns.
Affected products
- warpdotdev Warp >= 0.2025.04.09.08.11.stable_00, < 0.2026.05.06.15.42.stable_01
Timeline
- 2026-05-05: other: Fixing commit authored
- 2026-06-09: patched: Advisory published and fix released in version 0.2026.05.06.15.42.stable_01
- 2026-06-24: advisory: NVD published CVE-2026-48703