CVE-2026-48732 Overview
CVE-2026-48732 is a command injection vulnerability [CWE-78] in Warp, an agentic development environment. The flaw exists in the legacy SSH background command path used for metadata collection over SSH-backed sessions. Warp built helper commands using the remote working directory string reported by the session, without escaping shell metacharacters. An attacker who controls a remote host, repository, or directory name can inject additional shell syntax that executes on the remote host as the victim's authenticated SSH user. The issue affects Warp versions from 0.2023.03.21.08.02.stable_00 through versions before 0.2026.05.06.15.42.stable_01.
Critical Impact
Attackers controlling a remote host or repository path can execute arbitrary shell commands as the victim's authenticated SSH account when Warp collects metadata over SSH.
Affected Products
- Warp terminal versions from 0.2023.03.21.08.02.stable_00
- All releases prior to 0.2026.05.06.15.42.stable_01
- SSH-backed remote session metadata collection component
Discovery Timeline
- 2026-06-24 - CVE-2026-48732 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-48732
Vulnerability Analysis
The vulnerability resides in Warp's remote SSH command executor, specifically in the helper command logic that retrieves shell history and other metadata from a remote host. Warp interpolated the remote working directory path directly into a shell command string before sending it over SSH. Because the path was not escaped or quoted, shell metacharacters such as ;, $(), and backticks were interpreted by the remote shell. An attacker who controls the name of a directory, Git repository, or host that the victim navigates to can embed shell syntax in that name. When Warp issues the helper command, that syntax executes on the remote host under the victim's SSH credentials. This permits arbitrary command execution within the bounds of the SSH session's account.
Root Cause
The root cause is unsanitized string interpolation when constructing shell commands. The history-file path returned by the remote session was concatenated into a cat $history_file invocation without single-quote escaping. This is a classic OS command injection pattern tracked under [CWE-78].
Attack Vector
Exploitation requires user interaction: the victim must connect via SSH through Warp to a host or directory whose name contains attacker-controlled payload. Possible delivery channels include malicious Git repository names, crafted directory names on shared infrastructure, or a hostile SSH server that reports a malicious working directory. The injected commands execute with the privileges of the victim's SSH session.
// Patch from app/src/terminal/model/session.rs
.as_deref()
.map(|path| HashMap::from_iter([("PATH".to_string(), path.to_string())]));
+ let escaped_history_file =
+ shell_escape_single_quotes(history_file, self.info.shell.shell_type());
let output_in_bytes = self
.execute_command(
- format!("cat {history_file}").as_str(),
+ format!("cat '{escaped_history_file}'").as_str(),
None,
env_vars,
ExecuteCommandOptions::default(),
// Source: https://github.com/warpdotdev/warp/commit/88c344e2de662a935f0ef0896458494ef2413add
The fix wraps the history_file value with shell_escape_single_quotes and places it inside single quotes, neutralizing shell metacharacters. See the GitHub Security Advisory GHSA-qqpc-wvvw-4269 for additional detail.
Detection Methods for CVE-2026-48732
Indicators of Compromise
- Unexpected child processes spawned by the SSH session shell on remote hosts shortly after a Warp connection or directory change.
- Shell history entries on remote hosts containing cat invocations with embedded ;, $(), or backtick sequences in the path argument.
- Directory, repository, or hostname strings that contain shell metacharacters such as $(...), ` `, or semicolons.
Detection Strategies
- Audit Warp client versions across developer endpoints and flag installs older than 0.2026.05.06.15.42.stable_01.
- Inspect SSH server-side auth and audit logs for command patterns matching cat followed by unquoted paths containing shell control characters.
- Correlate Warp session start events with subsequent anomalous process creation on remote hosts.
Monitoring Recommendations
- Enable auditd or equivalent process auditing on SSH-accessible servers and alert on unusual child processes of the user's login shell.
- Monitor Git clone operations for repository names containing shell metacharacters before checkout.
- Track outbound SSH sessions from developer workstations running vulnerable Warp builds.
How to Mitigate CVE-2026-48732
Immediate Actions Required
- Upgrade Warp to version 0.2026.05.06.15.42.stable_01 or later on all developer workstations.
- Inventory and remove any unmaintained Warp installations on shared or build-system hosts.
- Review recent SSH session activity from Warp clients for signs of unexpected command execution.
Patch Information
The vulnerability is fixed in Warp 0.2026.05.06.15.42.stable_01. The remediation adds shell_escape_single_quotes handling around the remote history_file value before it is interpolated into the cat helper command. Patch details are available in the GitHub commit 88c344e.
Workarounds
- Avoid using Warp's SSH-backed sessions to connect to untrusted hosts until the client is updated.
- Do not cd into directories or clone repositories with names containing shell metacharacters while using a vulnerable Warp build.
- Where feasible, restrict SSH accounts used from Warp to least-privilege roles with restricted shells.
# Verify installed Warp version on macOS
defaults read /Applications/Warp.app/Contents/Info.plist CFBundleShortVersionString
# Verify on Linux
warp-terminal --version
# Required minimum version: 0.2026.05.06.15.42.stable_01
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
