CVE-2026-48704: Warp Arbitrary File Execution via Malicious Markdown Links

Technical summary

The vulnerability stems from improper validation of local file URIs in Markdown link handling (CWE-20: Improper Input Validation). Affected Warp versions fail to restrict the types of local files that can be opened via user-clicked links, instead delegating file handling directly to the OS default handler. An attacker can craft Markdown containing a crafted local-file URI that resolves to an executable or script. When rendered, the link may appear innocuous due to text/display mismatch, but clicking it triggers the OS to execute the file rather than open it in a text editor or viewer. The flaw requires user interaction (clicking the link) but affects any locally accessible file, making privilege escalation and lateral movement possible if the developer has broader system permissions.

Business impact

For development teams using Warp, this vulnerability creates a supply-chain risk vector. Malicious or compromised project repositories, shared Markdown documentation, or collaborative files can be weaponized to execute code on developer machines without additional authentication. This is particularly concerning in environments where developers have elevated privileges or access to production systems, CI/CD pipelines, or sensitive credentials. A single click on a deceptively labeled link in a project's README or documentation can lead to machine compromise, theft of SSH keys, container registry credentials, or other secrets commonly stored in developer environments.

Affected systems

Warp versions from 0.2023.10.24.08.03.stable_00 through 0.2026.05.06.15.41.stable_00 (inclusive) are affected. The vulnerability is fixed in version 0.2026.05.06.15.42.stable_01 and later. The issue is platform-agnostic in principle, though the practical impact depends on the OS default file handler behavior and the files accessible to the user running Warp. Developers across all platforms (Linux, macOS, Windows) who use affected Warp builds are at risk.

Exploitability

Exploitability is high due to low attack complexity and the human element of social engineering. No special privileges are required to craft a malicious Markdown file or project. An attacker needs only to convince a user to open the project in Warp and click a link—both actions users perform routinely. The CVSS 3.1 score of 8.8 (HIGH) reflects network attack vector, lack of privilege requirements, and high impact across confidentiality, integrity, and availability. However, the attack requires user interaction; it is not wormable or self-propagating. Public exploit code has not been disclosed, and the vulnerability is not yet tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Update Warp to version 0.2026.05.06.15.42.stable_01 or later. Users should prioritize this patch if they regularly open projects or Markdown documents from untrusted or less-vetted sources. Organizations should also review access controls and privilege levels granted to developer machines, ensuring that developer accounts do not have unnecessary permissions to install software or access production systems.

Patch guidance

1. Check your current Warp version via the application's About or Settings menu. 2. Download and install version 0.2026.05.06.15.42.stable_01 from the official Warp website or your package manager. 3. Verify successful installation by confirming the new version number appears in About/Settings. 4. Close and reopen any Markdown documents or projects to ensure the patched version is active. 5. Consider enabling automatic updates if available to catch future patches more quickly. If your organization manages Warp deployments via configuration management, update deployment templates and test the patched version in a development environment before broad rollout.

Detection guidance

Monitor for suspicious file executions originating from Warp or temp directories associated with Warp's operation, especially unexpected launches of PowerShell, bash, Python interpreters, or other script engines. Check endpoint detection and response (EDR) or system audit logs for child processes spawned from the Warp application. Audit git clone or file download activity to identify potentially malicious project repositories introduced recently. Review Markdown files in active projects for local-file:// URIs or suspicious link text that does not match the displayed content. Code review and pull request processes should include a cursory check for Markdown files with embedded local file links, particularly if external contributors are involved.

Why prioritize this

This vulnerability merits immediate attention despite lacking KEV status because it combines moderate-to-high CVSS severity with practical exploitability against a target (software developers) who often have elevated system access and handle third-party code regularly. The social engineering component and the prevalence of Markdown in development workflows make exploitation relatively likely. A single click by a developer can compromise an entire machine or its secrets. Organizations with active Warp deployments should patch within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is justified by: (1) Network-accessible attack vector—malicious projects can be shared via git, email, or collaboration platforms; (2) Low attack complexity—no special conditions or race conditions required; (3) No privileges required—any user running Warp can be targeted; (4) User interaction required, but in a natural workflow context; (5) High impact on confidentiality, integrity, and availability—successful exploitation can lead to arbitrary code execution, file exfiltration, and system compromise. The score does not account for the developer-centric nature of the target or the likelihood of elevated privileges, which would compound the real-world risk in many organizations.

Frequently asked questions