CVE-2026-48719: Warp Development Environment RCE Vulnerability

CVE-2026-48719 Overview

CVE-2026-48719 is a command injection vulnerability in Warp, an agentic development environment. The flaw resides in the prompt branch selector and affects versions from 0.2025.08.06.08.12.stable_00 until 0.2026.05.06.15.42.stable_01. An attacker who can publish a branch to a Git repository opened in Warp can craft a malicious branch name. When the victim selects that branch from the UI, the victim's shell interprets the embedded commands. The issue is tracked under CWE-78 (OS Command Injection) and is fixed in version 0.2026.05.06.15.42.stable_01.

Critical Impact
Successful exploitation allows arbitrary command execution on the victim's workstation with the privileges of the Warp user, leading to full local compromise of developer environments.

Affected Products

Warp versions from 0.2025.08.06.08.12.stable_00 through versions prior to 0.2026.05.06.15.42.stable_01
Warp client integrations that parse Git branch names through the prompt branch selector UI
Developer workstations running affected Warp builds with repositories that accept external branch contributions

Discovery Timeline

2026-06-24 - CVE-2026-48719 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-48719

Vulnerability Analysis

Warp's prompt branch selector renders Git branch names as interactive display chips inside the agent input footer. The affected code paths in app/src/context_chips/display.rs and app/src/ai/blocklist/agent_view/agent_input_footer/mod.rs constructed shell commands from branch metadata without proper isolation between data and code. The original implementation used a format_git_branch_command helper that concatenated branch names into shell-interpreted strings. When a user clicked a chip representing a branch with a name containing shell metacharacters, the embedded payload executed in the victim's shell context.

Root Cause

The root cause is improper neutralization of special elements in branch identifiers used as input to shell commands. Git permits a wide range of characters in branch names, including substrings that shells interpret as command substitution, pipes, or separators. Warp passed these strings directly into command construction logic rather than treating branch names as untrusted data requiring strict argument-array invocation.

Attack Vector

The attack requires an attacker with permission to push or propose a branch to a Git repository that the victim opens in Warp. The attacker creates a branch whose name contains shell control characters and waits for the victim to interact with the branch via the prompt UI. Selection of the chip triggers execution. User interaction is required, but the action appears benign and consistent with normal developer workflow.

rust

// Patch from app/src/context_chips/display.rs
 use crate::ai::document::ai_document_model::{AIDocumentId, AIDocumentVersion};
 use crate::completer::SessionContext;
-use crate::context_chips::display_chip::{format_git_branch_command, DisplayChipAction};
+use crate::context_chips::display_chip::{DisplayChipAction, PromptChipShellCommand};
 use crate::settings::InputSettings;
 use crate::terminal::input::MenuPositioningProvider;
 use crate::terminal::model_events::ModelEventDispatcher;

Source: GitHub Commit 4295ec0. The patch removes the string-based format_git_branch_command helper and replaces it with a PromptChipShellCommand abstraction that separates command structure from untrusted branch data.

Detection Methods for CVE-2026-48719

Indicators of Compromise

Git branches with names containing shell metacharacters such as `, $(, ;, &&, ||, or |
Unexpected child processes spawned by the Warp terminal binary shortly after a UI interaction
Outbound network connections originating from developer shells without corresponding user-initiated commands
Modification of shell startup files (~/.bashrc, ~/.zshrc, ~/.profile) on developer endpoints

Detection Strategies

Inspect Git repository refs for branch names containing non-printable or shell-significant characters using git for-each-ref refs/heads refs/remotes
Monitor process ancestry on developer workstations for shells invoked by Warp with anomalous argument strings
Alert on EDR telemetry showing Warp spawning utilities such as curl, wget, bash -c, or python -c outside expected developer workflows
Audit Warp client versions across the fleet and flag any installation below 0.2026.05.06.15.42.stable_01

Monitoring Recommendations

Forward endpoint process-creation events from developer machines to a centralized analytics platform for retrospective hunting
Track Git server logs for branch creations containing suspicious characters across repositories accessible to multiple contributors
Continuously inventory Warp client versions through software asset management and correlate with the fixed release

How to Mitigate CVE-2026-48719

Immediate Actions Required

Upgrade all Warp installations to version 0.2026.05.06.15.42.stable_01 or later
Audit existing Git repositories opened in Warp for branches with names containing shell metacharacters and delete or rename them
Restrict branch creation permissions on shared repositories to trusted contributors where feasible
Communicate the issue to developer teams and instruct them not to interact with unfamiliar branches in the Warp UI until upgrades are complete

Patch Information

The vendor fix is available in Warp 0.2026.05.06.15.42.stable_01. The patch introduces a PromptChipShellCommand type that replaces the prior string-formatting approach used in format_git_branch_command. Details are published in GitHub Security Advisory GHSA-hgvx-4xvm-39pw and the upstream commit.

Workarounds

Avoid opening untrusted Git repositories in vulnerable Warp versions until the client is upgraded
Disable or avoid the prompt branch selector workflow on affected versions and run git checkout manually with validated branch names
Enforce server-side Git hooks that reject branch names containing shell metacharacters using pre-receive validation

bash

# Example pre-receive hook to reject dangerous branch names
#!/bin/bash
while read oldrev newrev refname; do
  branch="${refname#refs/heads/}"
  if [[ "$branch" =~ [\`\$\;\&\|\(\)] ]]; then
    echo "Rejected: branch name '$branch' contains shell metacharacters"
    exit 1
  fi
done
exit 0