CVE-2026-54686: Warp terminal lifecycle hook spoofing in PTY stream

CVE-2026-54686 · Severity: medium · CVSS 4.3 · Published 2026-06-24

Warp is a modern terminal and development environment. A vulnerability allowed malicious terminal output to trick the application into misidentifying session metadata, such as the current working directory or SSH connection details. If a user views specially crafted text (for example, by downloading a malicious file or connecting to a compromised server), it could cause the terminal to behave incorrectly or misrepresent the user's current environment, potentially leading to operational errors.

Quick answers

Is CVE-2026-54686 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54686 being exploited in the wild.
How severe is CVE-2026-54686?
Medium severity, with a CVSS score of 4.3, published 24 June 2026.
Which products and versions are affected?
warpdotdev Warp >= 0.2021.04.25.23.05.stable_00, < 0.2026.05.06.15.42.stable_01.
Is there a fix for CVE-2026-54686?
A patch was published on 2026-05-07: Initial fix commit for DCS hook integrity checks Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54686 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54686?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Warp accepted state-mutating terminal lifecycle hooks (DCS hooks) from the PTY stream without verifying their origin. An attacker who can control terminal output viewed by a victim—such as through a malicious script, file content, or a compromised SSH session—can spoof lifecycle metadata. This includes the current working directory (CWD) and SSH session transport metadata. The root cause is a lack of integrity checks on hooks emitted by shell integrations. The fix introduces client-generated session IDs that must be registered and validated before Warp accepts state-mutating hooks. This vulnerability is addressed in version 0.2026.05.06.15.42.stable_01.

Affected products

  • warpdotdev Warp >= 0.2021.04.25.23.05.stable_00, < 0.2026.05.06.15.42.stable_01

Timeline

  • 2026-05-07: patched: Initial fix commit for DCS hook integrity checks
  • 2026-06-09: advisory: GitHub Security Advisory GHSA-9w2v-jhww-vm85 published
  • 2026-06-24: disclosed: CVE-2026-54686 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.