Executive brief
Warp is a modern terminal and development environment. A security flaw allowed malicious terminal output to automatically create or overwrite files on a user's computer without any confirmation. This could allow an attacker to gain persistent access to a developer's machine or execute unauthorized commands if the user views malicious content in their terminal.
Technical details
Warp versions from 0.2025.03.05.08.02.stable_00 to 0.2026.05.06.15.42.stable_01 incorrectly handle iTerm2-style 'OSC 1337;File' escape sequences. The terminal processes non-inline file payloads by automatically decoding and materializing them as local files in the current working directory without user confirmation. An attacker can exploit this by tricking a user into displaying malicious output (e.g., via SSH, catting a malicious file, or build logs). This can result in the truncation or overwriting of critical configuration files (like .zshrc or .bashrc), leading to delayed command execution or persistence. The vulnerability is fixed in version 0.2026.05.06.15.42.stable_01 by disabling automatic writes for non-inline payloads.
Affected products
- warpdotdev Warp >= 0.2025.03.05.08.02.stable_00, < 0.2026.05.06.15.42.stable_01
Timeline
- 2026-06-09: advisory: GitHub Security Advisory published by vendor
- 2026-06-24: disclosed: CVE published to NVD
- 2026-05-06: patched: Fixed in version 0.2026.05.06.15.42.stable_01