# CVE-2026-54686: Warp terminal lifecycle hook spoofing in PTY stream

Source: https://junglewise.ai/threats/cve-2026-54686-warp-terminal-lifecycle-hook-spoofing-in-pty-stream  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-54686 · Severity: medium · CVSS 4.3 · Published 2026-06-24

Warp is a modern terminal and development environment. A vulnerability allowed malicious terminal output to trick the application into misidentifying session metadata, such as the current working directory or SSH connection details. If a user views specially crafted text (for example, by downloading a malicious file or connecting to a compromised server), it could cause the terminal to behave incorrectly or misrepresent the user's current environment, potentially leading to operational errors.

## Quick answers

**Is CVE-2026-54686 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54686 being exploited in the wild.

**How severe is CVE-2026-54686?** Medium severity, with a CVSS score of 4.3, published 24 June 2026.

**Which products and versions are affected?** warpdotdev Warp >= 0.2021.04.25.23.05.stable_00, < 0.2026.05.06.15.42.stable_01.

**Is there a fix for CVE-2026-54686?** A patch was published on 2026-05-07: Initial fix commit for DCS hook integrity checks Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54686 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54686?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Warp accepted state-mutating terminal lifecycle hooks (DCS hooks) from the PTY stream without verifying their origin. An attacker who can control terminal output viewed by a victim—such as through a malicious script, file content, or a compromised SSH session—can spoof lifecycle metadata. This includes the current working directory (CWD) and SSH session transport metadata. The root cause is a lack of integrity checks on hooks emitted by shell integrations. The fix introduces client-generated session IDs that must be registered and validated before Warp accepts state-mutating hooks. This vulnerability is addressed in version 0.2026.05.06.15.42.stable_01.

## Affected products

- warpdotdev Warp >= 0.2021.04.25.23.05.stable_00, < 0.2026.05.06.15.42.stable_01

## Timeline

- 2026-05-07: patched: Initial fix commit for DCS hook integrity checks
- 2026-06-09: advisory: GitHub Security Advisory GHSA-9w2v-jhww-vm85 published
- 2026-06-24: disclosed: CVE-2026-54686 published to NVD

## References

- [https://github.com/warpdotdev/warp/commit/32d21d15c9a3da1a923d1ed66226cf5cba081d16](https://github.com/warpdotdev/warp/commit/32d21d15c9a3da1a923d1ed66226cf5cba081d16)
- [https://github.com/warpdotdev/warp/commit/51bd3267803c5cc0a45074fa19fd50162be7c917](https://github.com/warpdotdev/warp/commit/51bd3267803c5cc0a45074fa19fd50162be7c917)
- [https://github.com/warpdotdev/warp/security/advisories/GHSA-9w2v-jhww-vm85](https://github.com/warpdotdev/warp/security/advisories/GHSA-9w2v-jhww-vm85)