Executive brief
Warp is a modern terminal and development environment. A security flaw allowed malicious programs or remote servers to automatically read from or write to your computer's clipboard without permission. This could lead to the theft of sensitive information like passwords or API keys copied to the clipboard, or the insertion of malicious commands into your workflow.
Technical details
Warp versions prior to 0.2026.05.06.15.42.stable_01 incorrectly handled the OSC 52 terminal escape sequence, which is used for clipboard operations. By default, the application allowed any terminal output—including output from remote SSH hosts or malicious scripts—to trigger clipboard reads and writes without a confirmation prompt. An attacker can exploit this by sending crafted escape sequences to a user's terminal, allowing them to exfiltrate sensitive clipboard data or perform clipboard hijacking. The fix introduces a configuration setting that defaults OSC 52 access to 'deny'.
Affected products
- warpdotdev Warp >= 0.2021.04.25.23.05.stable_00, < 0.2026.05.06.15.42.stable_01
Timeline
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD
- 2026-05-06: patched: Fixed in version 0.2026.05.06.15.42.stable_01