Executive brief
Warp, an AI-powered terminal and development environment, contains a security flaw in its CLI agent. The agent is designed to block certain dangerous commands (like deleting files) unless the user confirms them. However, an attacker could bypass these safety checks by adding environment variables to the start of a command, potentially allowing malicious code to run automatically on a user's computer without their permission.
Technical details
A vulnerability exists in Warp's unsandboxed CLI agent profile where command strings are validated against a denylist before canonicalizing leading environment-variable assignments. Because the denylist check operates on raw strings, an attacker can prepend assignments (e.g., 'X=1 rm -rf /') to bypass safety boundaries that would otherwise require user confirmation. This is classified as CWE-180 (Validate Before Canonicalize). Exploitation requires the victim to run the agent on attacker-controlled or prompt-injectable context. The fix, introduced in version 0.2026.05.06.15.42.stable_01, strips leading environment variables before evaluating denylist predicates.
Affected products
- warpdotdev Warp >= 0.2025.10.08.08.12.stable_00, < 0.2026.05.06.15.42.stable_01
Timeline
- 2026-05-05: patched: Fixing commit authored
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: NVD publication date