CVE-2026-48703: Warp Development Environment RCE Vulnerability

CVE-2026-48703 Overview

Warp, an agentic development environment, contains a command execution policy bypass in its Agent code search tools. The flaw affects versions from 0.2025.04.09.08.11.stable_00 through 0.2026.05.06.15.42.stable_01. The Grep and FileGlob actions are authorized as read-only search operations, but their implementations construct shell command strings from Agent-controlled inputs and execute them in the active terminal session. Attackers can leverage search text, paths, and glob patterns to inject arbitrary commands [CWE-78]. The vulnerability is fixed in version 0.2026.05.06.15.42.stable_01.

Critical Impact
An attacker who influences Agent inputs can execute arbitrary OS commands in the user's terminal session, bypassing the read/search authorization policy and achieving full local code execution under the user's privileges.

Affected Products

Warp terminal versions 0.2025.04.09.08.11.stable_00 through 0.2026.05.06.15.42.stable_01
Warp Agent Grep code search action
Warp Agent FileGlob code search action

Discovery Timeline

2026-06-24 - CVE-2026-48703 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-48703

Vulnerability Analysis

The vulnerability is an OS Command Injection [CWE-78] within Warp's Agent tooling. Warp's authorization model categorizes Grep and FileGlob actions as benign read or search operations, allowing them to run without the elevated consent prompts required for arbitrary command execution. The underlying implementations, however, build shell command strings by concatenating Agent-controlled values into a command line that is then executed by the active terminal session shell.

Because shell metacharacters such as ;, |, $(), and backticks are not neutralized before interpolation, an Agent that has been steered by adversarial inputs, such as a prompt injection payload embedded in a fetched document or source file, can smuggle additional commands through the search text, file paths, or glob patterns. The injected commands execute with the privileges of the local user.

Root Cause

The root cause is unsafe construction of shell command strings from untrusted argument values. The patch in app/src/terminal/model/session/command_executor/shared.rs introduces a shell_quote_arg helper that wraps each interpolated argument in single quotes after escaping embedded single quotes. This forces the shell to treat each value as a literal data argument rather than as shell syntax.

Attack Vector

Exploitation requires local execution context within Warp and user interaction with the Agent. A remote influence path is possible when the Agent ingests attacker-controlled content, such as a malicious repository file, web page, or issue tracker entry, that triggers a Grep or FileGlob invocation with injection payloads in its parameters.

rust

// Security patch: shared.rs - introduces shell_quote_arg helper
// Source: https://github.com/warpdotdev/warp/commit/43f4f483e0c2dd253d2aaa8a495b2d71f0208c40

/// Quotes a single shell argument so it is passed as data instead of being
/// interpreted as shell syntax.
///
/// Use this for complete interpolated arguments in generated command strings,
/// not for fragments that intentionally contain operators, pipes, or flags.
pub fn shell_quote_arg(value: &str, shell_type: ShellType) -> String {
    format!("'{}'", shell_escape_single_quotes(value, shell_type))
}

Source: GitHub commit 43f4f483

Detection Methods for CVE-2026-48703

Indicators of Compromise

Warp terminal sessions executing unexpected child processes such as sh -c, bash -c, curl, wget, or python originating from a Grep or FileGlob action context.
Shell history entries containing grep or glob commands with embedded shell metacharacters like ;, &&, $(), or backticks in search arguments.
Outbound network connections from the terminal process shortly after an Agent search action.

Detection Strategies

Inventory installed Warp versions across developer workstations and flag any build older than 0.2026.05.06.15.42.stable_01.
Hunt for process trees in which the Warp terminal binary spawns interpreters or networking utilities with arguments containing shell control characters.
Correlate Warp Agent activity logs with endpoint telemetry to identify command executions that do not match a legitimate read or search workflow.

Monitoring Recommendations

Enable command-line auditing on developer endpoints to capture full argument lists for shell invocations.
Alert on file system writes, credential file reads, or SSH key access that follow Warp Agent search operations.
Track DNS and egress traffic from terminal applications to detect data exfiltration following Agent-driven command execution.

How to Mitigate CVE-2026-48703

Immediate Actions Required

Upgrade Warp to version 0.2026.05.06.15.42.stable_01 or later on all developer workstations.
Restrict Warp Agent autonomy until the patch is deployed, requiring explicit user confirmation for every tool action.
Audit recent Agent session transcripts for Grep or FileGlob invocations containing shell metacharacters in their parameters.

Patch Information

The fix is delivered in Warp 0.2026.05.06.15.42.stable_01. The patch adds a shell_quote_arg function in app/src/terminal/model/session/command_executor/shared.rs that single-quotes every interpolated argument, and updates the Grep and FileGlob executors to use it. Review the GitHub Security Advisory GHSA-8r78-7jwh-m6hm for vendor guidance.

Workarounds

Disable the Agent or run Warp without granting it permission to execute search tools until the upgrade is applied.
Avoid feeding the Agent untrusted content such as third-party repositories, web pages, or documents that could carry prompt injection payloads targeting Grep or FileGlob.
Run Warp under a least-privileged local user account that cannot reach sensitive credentials or production systems.

bash

# Verify installed Warp version and upgrade on macOS
mdls -name kMDItemVersion /Applications/Warp.app
# Then download and install 0.2026.05.06.15.42.stable_01 or later from the vendor