CVE-2026-48704: Warp RCE Vulnerability via Malicious Links

CVE-2026-48704 Overview

CVE-2026-48704 affects Warp, an agentic development environment that renders Markdown content within its interface. The vulnerability allows a malicious Markdown document or project to embed a local-file link that appears as normal rendered content. When a user clicks the link, affected builds route the resolved local file to the operating system's default file handler instead of restricting the action to safe viewer or editor targets. Attackers can leverage this behavior to execute arbitrary code by pointing the link at an executable file, such as an extensionless shell script. The flaw is classified under [CWE-20] Improper Input Validation. Warp resolved the issue in build 0.2026.05.06.15.42.stable_01.

Critical Impact
A crafted Markdown link in Warp can trigger arbitrary code execution by delegating local file opens to the OS default handler.

Affected Products

Warp from 0.2023.10.24.08.03.stable_00 through builds prior to 0.2026.05.06.15.42.stable_01
All platforms where Warp uses a system default file handler for local file opens
Markdown rendering surfaces in Warp notebooks and project views

Discovery Timeline

2026-06-24 - CVE-2026-48704 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-48704

Vulnerability Analysis

Warp renders Markdown content inside notebooks and project documents. Markdown supports link syntax that resolves to local filesystem paths. In affected builds, the link handler did not constrain target types before dispatching the open action. When the resolved target was not a recognized viewer or editor target, Warp passed the path to the operating system default file opener. This behavior allowed executable binaries, shell scripts, and other actionable file types to launch with user privileges. The attack requires user interaction in the form of clicking the link, but the malicious link can appear identical to a benign documentation reference.

Root Cause

The link-open routine in app/src/notebooks/link.rs lacked validation for targets that would be handed to the OS default handler. Paths classified as SystemGeneric or SystemDefault were dispatched directly to the platform opener without checking whether the target was an executable or unsafe file type.

Attack Vector

An attacker authors a Markdown document containing a link whose visible text resembles legitimate documentation. The link target points to a local executable, such as a payload dropped earlier or staged inside the repository. The victim opens the document in Warp and clicks the link. Warp resolves the path and routes it to the platform file opener, which executes the payload under the user's context.

rust

// Security patch in app/src/notebooks/link.rs
/// Open a file respecting user's editor settings.
///
/// For targets that would be handed to the OS default handler (`SystemGeneric` /
/// `SystemDefault`), we reveal the file in Finder / Explorer instead of opening it.
/// This prevents a malicious markdown link from triggering arbitrary code execution
/// via an executable disguised as a local file (e.g. an extensionless shell script).
// The `line_and_column` argument is unused when there is no local filesystem.
#[cfg_attr(not(feature = "local_fs"), allow(unused_variables))]
fn open_file(

Source: GitHub commit 7f0c4dd

Detection Methods for CVE-2026-48704

Indicators of Compromise

Warp processes spawning child processes that resolve to shell interpreters, scripting engines, or extensionless binaries originating from repository or downloads directories
Markdown files inside cloned repositories that contain links with file:// or relative paths pointing to executable targets
New executable files written into project directories shortly before a Warp session opens them

Detection Strategies

Monitor process lineage where the parent is the Warp binary and the child is sh, bash, zsh, osascript, cmd.exe, powershell.exe, or a binary from a user-writable directory
Inspect Markdown content in shared repositories for link targets resolving to executable file types or files without extensions
Alert on Warp builds older than 0.2026.05.06.15.42.stable_01 reported by endpoint inventory

Monitoring Recommendations

Capture command-line telemetry from developer endpoints and correlate child process executions against Warp parent PIDs
Track file creation events in repository working directories for executable bits set on new files
Review user reports of unexpected applications launching after clicking Markdown links in Warp

How to Mitigate CVE-2026-48704

Immediate Actions Required

Upgrade Warp to build 0.2026.05.06.15.42.stable_01 or later on all developer workstations
Audit installed Warp versions across macOS, Linux, and Windows endpoints and prioritize hosts running affected builds
Instruct developers to avoid clicking local file links in untrusted Markdown documents or third-party repositories until patching completes

Patch Information

Warp released the fix in build 0.2026.05.06.15.42.stable_01. The patch modifies app/src/notebooks/link.rs to reveal files in Finder or Explorer rather than invoking the OS default opener for SystemGeneric and SystemDefault targets. Details are available in the Warp security advisory GHSA-589x-4mxh-jcrf and the upstream commit.

Workarounds

Do not open Markdown documents from untrusted sources inside Warp notebooks until the patched build is deployed
Strip or review Markdown link targets in shared repositories before opening them in Warp
Restrict execute permissions on files inside cloned repositories to reduce the impact of accidental link clicks

bash

# Verify the installed Warp version on macOS
defaults read /Applications/Warp.app/Contents/Info.plist CFBundleShortVersionString

# On Linux, query the package manager (example for Debian-based systems)
dpkg -l | grep -i warp