CVE-2024-41997

Name of the Vulnerable Software and Affected Versions: Warp Terminal versions prior to 2024.07.18 (v0.2024.07.16.08.02)

Description: A command injection vulnerability exists in the Docker integration functionality of Warp Terminal. An attacker can create a specially crafted hyperlink using the warp://action/docker/open subshell intent that, when clicked by the victim, results in command execution on the victim's machine. The issue is related to incorrect code generation management in the Docker Integration component.

Recommendations: For versions prior to 2024.07.18 (v0.2024.07.16.08.02), update to a version released after 2024.07.18 to resolve the issue. As a temporary workaround, consider disabling the Docker integration functionality until a patch is available. Restrict access to the warp://action/docker/open subshell intent to minimize the risk of exploitation.