CVE-2026-54686

Name of the Vulnerable Software and Affected Versions Warp versions 0.2021.04.25.23.05.stable 00 through 0.2026.05.06.15.42.stable 00

Description Warp accepts state-mutating terminal lifecycle hooks from the PTY (Pseudo-Terminal) stream without verifying if the hooks were emitted by the shell integration for the active session. An attacker capable of inducing a victim to view attacker-controlled terminal output can spoof lifecycle metadata, such as the current working directory for the active block or SSH session transport metadata.

Recommendations Update to version 0.2026.05.06.15.42.stable 01.