CVE-2026-48732

Name of the Vulnerable Software and Affected Versions Warp versions 0.2023.03.21.08.02.stable 00 through 0.2026.05.06.15.42.stable 00

Description A command injection issue exists in the legacy SSH background command path. The software uses the remote working directory reported by the session to build helper commands for SSH-backed metadata collection. An attacker controlling a remote host, repository, or directory name can trigger the execution of additional shell syntax on the remote host using the victim's authenticated SSH account.

Recommendations Update to version 0.2026.05.06.15.42.stable 01.