PT-2026-52035 · Warp · Warp
CVE-2026-54699
·
Published
2026-06-24
·
Updated
2026-06-24
CVSS v3.1
7.7
High
| Vector | AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Warp versions 0.2024.03.12.08.02.stable 01 through 0.2026.05.06.15.42.stable 01
Description
An OS command injection issue exists in the WSL URL-opening fallback. When the application runs under WSL and fails to open a URL via wslview, it reverts to a Windows command processor path. An attacker can trigger this fallback by providing a malicious URL through terminal output, which is then executed when the user opens the link.
Recommendations
Update Warp to version 0.2026.05.06.15.42.stable 01.
Exploit
Fix
Improper Encoding or Escaping of Output
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Warp