CVE-2026-48725: Warp Information Disclosure Vulnerability

CVE-2026-48725 Overview

Warp is an agentic development environment that integrates AI-assisted workflows into a terminal interface. CVE-2026-48725 allows terminal output to access the local system clipboard without user confirmation. A malicious remote host, remote program, or any attacker-controlled terminal output source can trigger clipboard reads or writes through OSC 52 escape sequences. This behavior crosses the trust boundary between untrusted terminal output and the user's local desktop clipboard. The flaw is categorized as an Incorrect Default Permissions issue [CWE-276]. Affected versions span 0.2021.04.25.23.05.stable_00 through versions prior to 0.2026.05.06.15.42.stable_01, where the issue is fixed.

Critical Impact
Untrusted terminal output can silently read or overwrite the user's system clipboard, enabling exfiltration of sensitive data such as passwords and injection of attacker-controlled commands.

Affected Products

Warp terminal 0.2021.04.25.23.05.stable_00 and later
All versions prior to 0.2026.05.06.15.42.stable_01
Warp agentic development environment across supported desktop platforms

Discovery Timeline

2026-06-24 - CVE-2026-48725 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-48725

Vulnerability Analysis

The vulnerability resides in Warp's handling of OSC 52 escape sequences. OSC 52 is an ANSI control sequence that lets terminal programs interact with the host system clipboard. Warp implemented both clipboard write (ClipboardStore) and clipboard read (ClipboardLoad) handlers without any consent gating. Any byte stream rendered by the terminal could therefore manipulate the clipboard. This includes output from a remote SSH session, a cat of an attacker-supplied file, or a compromised dependency emitting log messages. The clipboard is shared across all applications on the host, so writes can stage malicious commands and reads can exfiltrate credentials copied by the user.

Root Cause

The root cause is missing access control on a privileged interface [CWE-276]. The terminal treated remote terminal output as authorized to invoke clipboard operations. There was no configurable policy, no prompt, and no separation between clipboard read intent and clipboard write intent.

Attack Vector

An attacker delivers crafted escape sequences through any channel that produces terminal output. Example vectors include a malicious SSH banner, a poisoned log file viewed with tail, or output from a compromised CLI tool. User interaction is limited to viewing the output. Once rendered, the sequence triggers a silent clipboard read or write.

rust

// Patch: app/src/terminal/view.rs - Gate OSC 52 clipboard access behind user setting
ModelEvent::ClipboardStore(_, contents) => {
    let access = *TerminalSettings::as_ref(ctx).osc52_clipboard_access;
    if access.allows_write() {
        ctx.clipboard()
            .write(ClipboardContent::plain_text(contents.to_owned()));
    } else {
        log::info!(
            "OSC 52 clipboard write blocked by terminal.osc52_clipboard_access setting"
        );
    }
}
ModelEvent::ClipboardLoad(_, format) => {
    let access = *TerminalSettings::as_ref(ctx).osc52_clipboard_access;
    if access.allows_read() {
        self.write_to_pty(
            format(&TerminalView::read_from_clipboard(
                Some(self.shell_family(ctx)),
                ctx,
            ))
            .into_bytes(),
            ctx,
        );
    }
}
// Source: https://github.com/warpdotdev/warp/commit/b1a41d0b1aba9f40db1e5ceb695183452a894003

The patch introduces an Osc52ClipboardAccess enum with Deny, WriteOnly, and ReadWrite modes. The default is Deny, restoring the trust boundary.

Detection Methods for CVE-2026-48725

Indicators of Compromise

Presence of OSC 52 escape sequences (ESC ] 52 ; c ; <base64> BEL) in shell history, captured PTY logs, or recorded SSH sessions.
Warp client versions between 0.2021.04.25.23.05.stable_00 and any release prior to 0.2026.05.06.15.42.stable_01 running on developer endpoints.
Unexpected clipboard content changes immediately following remote terminal interactions.

Detection Strategies

Inspect terminal session recordings and proxy logs for the byte pattern \\x1b]52; originating from untrusted hosts or scripts.
Hunt for processes that emit OSC 52 sequences on developer workstations, including SSH sessions to untrusted infrastructure.
Audit installed Warp versions across managed endpoints and flag any build prior to 0.2026.05.06.15.42.stable_01.

Monitoring Recommendations

Enable endpoint telemetry that records clipboard API access patterns correlated with terminal process activity.
Forward terminal and shell logs to a central data lake to enable historical search for OSC 52 indicators.
Alert on Warp child processes interacting with credential stores immediately after rendering remote output.

How to Mitigate CVE-2026-48725

Immediate Actions Required

Upgrade all Warp installations to version 0.2026.05.06.15.42.stable_01 or later.
Verify the post-upgrade setting terminal.osc52_clipboard_access is set to Deny unless a specific workflow requires otherwise.
Rotate any credentials that may have been present on the clipboard while running vulnerable Warp builds against untrusted hosts.

Patch Information

The fix is delivered in Warp 0.2026.05.06.15.42.stable_01. The patch introduces the Osc52ClipboardAccess setting in app/src/terminal/settings.rs and gates ClipboardStore and ClipboardLoad handlers in app/src/terminal/view.rs. The default policy is Deny. See the Warp Security Advisory GHSA-wgqj-4c26-7c4g and the upstream commit b1a41d0 for technical details.

Workarounds

Avoid using vulnerable Warp builds to connect to untrusted remote hosts or render untrusted files until patched.
Pipe untrusted output through a filter that strips OSC sequences, for example sed $'s/\\x1b\\]52;[^\a]*\a//g'.
Restrict developer workstations from connecting to unmanaged SSH endpoints through network egress controls.

bash

# Verify Warp version and confirm OSC 52 policy after upgrade
warp --version
# Expect: 0.2026.05.06.15.42.stable_01 or later

# Inspect Warp settings for the new clipboard policy key
grep -R "osc52_clipboard_access" ~/.warp/ 2>/dev/null
# Recommended value: "deny"