CVE-2026-48721: Warp command execution permission-check bypass in CLI agent

CVE-2026-48721 · Severity: high · CVSS 8.6 · Published 2026-06-24

Warp, an AI-powered terminal and development environment, contains a security flaw in its CLI agent. The agent is designed to block certain dangerous commands (like deleting files) unless the user confirms them. However, an attacker could bypass these safety checks by adding environment variables to the start of a command, potentially allowing malicious code to run automatically on a user's computer without their permission.

Quick answers

Is CVE-2026-48721 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48721 being exploited in the wild.
How severe is CVE-2026-48721?
High severity, with a CVSS score of 8.6, published 24 June 2026.
Which products and versions are affected?
warpdotdev Warp >= 0.2025.10.08.08.12.stable_00, < 0.2026.05.06.15.42.stable_01.
Is there a fix for CVE-2026-48721?
A patch was published on 2026-05-05: Fixing commit authored Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48721 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-48721?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Warp's unsandboxed CLI agent profile where command strings are validated against a denylist before canonicalizing leading environment-variable assignments. Because the denylist check operates on raw strings, an attacker can prepend assignments (e.g., 'X=1 rm -rf /') to bypass safety boundaries that would otherwise require user confirmation. This is classified as CWE-180 (Validate Before Canonicalize). Exploitation requires the victim to run the agent on attacker-controlled or prompt-injectable context. The fix, introduced in version 0.2026.05.06.15.42.stable_01, strips leading environment variables before evaluating denylist predicates.

Affected products

  • warpdotdev Warp >= 0.2025.10.08.08.12.stable_00, < 0.2026.05.06.15.42.stable_01

Timeline

  • 2026-05-05: patched: Fixing commit authored
  • 2026-06-09: advisory: GitHub Security Advisory published
  • 2026-06-24: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.