CVE-2026-48720: Warp Path Traversal Vulnerability

CVE-2026-48720 Overview

CVE-2026-48720 affects Warp, an agentic development environment that includes a terminal interface. The vulnerability allows Warp to accept non-inline OSC 1337;File escape sequence payloads from terminal output and write the decoded payload to the local file system without requiring user confirmation. This behavior mirrors iTerm2's file download protocol but omits the safety prompt expected before persisting attacker-controlled content to disk. The flaw is classified under [CWE-20] Improper Input Validation. It impacts Warp builds from 0.2025.03.05.08.02.stable_00 up to but not including 0.2026.05.06.15.42.stable_01.

Critical Impact
Any process or remote resource that can write to a Warp terminal session can drop arbitrary files to the user's machine without interaction beyond viewing terminal output.

Affected Products

Warp terminal 0.2025.03.05.08.02.stable_00 through versions prior to 0.2026.05.06.15.42.stable_01
Warp desktop builds embedding the vulnerable terminal_model component
Workflows that render untrusted output (logs, SSH sessions, container shells) inside Warp

Discovery Timeline

2026-06-24 - CVE-2026-48720 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-48720

Vulnerability Analysis

Warp implements support for the iTerm2 proprietary OSC 1337;File=... escape sequence. This sequence allows terminal programs to embed base64-encoded file content directly in their output stream. iTerm2 supports two modes: inline display (showing the content as an image) and non-inline download (writing the file to disk). Warp processed the non-inline form by decoding the payload and persisting it to the local file system through a save_as_file helper. The terminal did not interrupt the operation with a user confirmation dialog. An attacker controlling any byte stream rendered in Warp can therefore plant files in user-writable locations. Realistic attack surfaces include cat on a malicious file, SSH connections to compromised hosts, container logs, CI output, and AI agent tool responses rendered through Warp's agentic workflow.

Root Cause

The root cause is missing input validation and missing user-in-the-loop confirmation for a privileged terminal escape sequence. Warp trusted the OSC 1337;File payload as if it were a legitimate local request rather than potentially attacker-controlled terminal output. The patch in commit f3b9ce1c8fd13d037526c447418d809087722daa removes the save_as_file import from app/src/terminal/model/terminal_model.rs and disables the iTerm file download path entirely, restricting OSC 1337;File handling to inline rendering only.

Attack Vector

Exploitation requires the victim to view attacker-controlled output inside a Warp terminal session. The attacker injects a crafted OSC 1337;File=name=<filename>;inline=0:<base64payload> sequence into any stream Warp renders. Warp decodes the base64 content and writes it to disk without prompting. An attacker can deliver the payload through compromised SSH hosts, hostile git log content, weaponized log files served by tail -f, or output from an AI tool call. Written files can include shell rc additions, SSH authorized_keys, autostart entries, or executables placed where the user later runs them.

rust

// Patch excerpt: app/src/terminal/model/terminal_model.rs
 use warpui::assets::asset_cache::Asset;
 use warpui::image_cache::ImageType;
 use warpui::r#async::executor::Background;
-#[cfg(not(target_family = "wasm"))]
-use warpui::util::save_as_file;
 use warpui::AppContext;
 
 use super::super::{AltScreen, BlockList};

Source: GitHub Commit f3b9ce1. The fix removes the dependency on save_as_file, eliminating the code path that materialized non-inline payloads to disk.

Detection Methods for CVE-2026-48720

Indicators of Compromise

Unexpected files appearing in the user's home directory, ~/Downloads, or working directory shortly after a Warp terminal session
Terminal output or logs containing the byte sequence \\x1b]1337;File= with inline=0 parameters
Modifications to shell startup files (~/.bashrc, ~/.zshrc, ~/.profile) or ~/.ssh/authorized_keys correlated with Warp process activity

Detection Strategies

Hunt process telemetry for warp or warp-terminal writing to sensitive paths such as shell rc files, SSH config, LaunchAgents, or ~/.config/autostart
Inspect captured terminal scrollback or pty logs for OSC 1337;File sequences with inline=0, which indicate download-mode payloads
Correlate Warp file-write events with preceding network reads from SSH, container exec, or HTTP fetch commands to identify remote-origin payloads

Monitoring Recommendations

Inventory Warp installations across developer endpoints and flag versions older than 0.2026.05.06.15.42.stable_01
Enable file integrity monitoring on developer workstation persistence locations and ingest events into a SIEM for correlation
Capture EDR file-creation telemetry with parent process attribution to surface Warp-originated writes outside expected directories

How to Mitigate CVE-2026-48720

Immediate Actions Required

Upgrade Warp to version 0.2026.05.06.15.42.stable_01 or later on all developer endpoints
Audit recent file system changes on workstations where vulnerable Warp builds were used to view untrusted output
Restrict use of Warp for sessions that render output from untrusted SSH hosts, containers, or AI tools until the patch is applied

Patch Information

The fix is published in Warp 0.2026.05.06.15.42.stable_01 and documented in GitHub Security Advisory GHSA-5h96-jrrq-6hxq. The code change is available in commit f3b9ce1, which disables the iTerm non-inline file download path and limits OSC 1337;File handling to inline content only.

Workarounds

Avoid using vulnerable Warp builds to view output from untrusted sources such as remote shells, log files, or third-party tool output
Pipe untrusted output through a sanitizer such as sed 's/\\x1b\]1337;[^\\x07]*\\x07//g' to strip iTerm2 escape sequences before display
Run Warp inside a least-privilege user account so any file writes land in a contained profile that can be audited and reset

bash

# Verify installed Warp version on macOS
defaults read /Applications/Warp.app/Contents/Info.plist CFBundleShortVersionString

# Strip OSC 1337 sequences from a captured log before viewing
sed -E $'s/\\x1b\\]1337;[^\\x07]*\\x07//g' suspicious.log > sanitized.log