Executive brief
Warp, an AI-powered terminal and development environment, contains a security flaw in how it handles remote SSH connections. An attacker could trick a user into navigating to a malicious directory or repository that triggers the execution of unauthorized commands on the user's remote server. This could allow an attacker to view, modify, or delete sensitive files and disrupt operations using the victim's own account permissions.
Technical details
A command injection vulnerability exists in Warp's legacy SSH background command path due to improper neutralization of special elements (CWE-78). The application fails to escape single quotes when building helper commands for SSH-backed metadata collection, specifically when using the remote working directory (cwd) or history file paths reported by the session. An attacker can craft a malicious directory name, repository name, or host string containing shell metacharacters. When a victim using an affected version of Warp (between 0.2023.03.21.08.02.stable_00 and 0.2026.05.06.15.42.stable_01) interacts with these attacker-controlled strings during an SSH session, the terminal executes the injected syntax on the remote host with the privileges of the authenticated SSH user. The issue is resolved in version 0.2026.05.06.15.42.stable_01 by implementing proper shell escaping for single quotes.
Affected products
- warpdotdev Warp >= 0.2023.03.21.08.02.stable_00, < 0.2026.05.06.15.42.stable_01
Timeline
- 2026-05-05: patched: Initial fix commit authored
- 2026-06-09: advisory: GitHub security advisory published
- 2026-06-24: disclosed: CVE published to NVD