Executive brief
Warp is a modern terminal and development environment. A security flaw in its Linux version allows an attacker to execute malicious commands on a user's computer if the user is tricked into opening a specially crafted file path using an external text editor. This could lead to a full compromise of the user's local account and data.
Technical details
A command injection vulnerability exists in Warp for Linux within the 'EditorMetadata::build_command()' function. The application improperly expanded freedesktop .desktop Exec templates by concatenating file paths and URLs into a single string and passing it to 'sh -c' without adequate escaping. An attacker can exploit this by providing a local file path containing shell metacharacters (e.g., semicolons or backticks). If a user opens such a path through an affected external editor integration, the embedded shell syntax executes with the permissions of the local user. The fix involves tokenizing Exec strings into an argument vector and using direct process execution instead of a shell.
Affected products
- warpdotdev Warp >= 0.2024.02.20.08.01.stable_01, < 0.2026.05.06.15.42.stable_01
Timeline
- 2026-05-05: patched: Fixing commit authored
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: NVD publication date