CVE-2026-48721: Warp CLI Agent Command Denylist Bypass

Technical summary

This vulnerability exploits a command validation flaw in Warp's unsandboxed CLI agent. The agent enforces safety through a command denylist that restricts commands requiring explicit user confirmation. The vulnerability arises from a canonicalization bypass: command strings are validated against the denylist before environment-variable prefixes are resolved. An attacker controlling the agent's command input can prepend environment-variable assignments (e.g., VAR=value denylisted_command) that cause the denylist check to pass, even though the denylisted command executes after variable assignment. This affects the default unsandboxed profile, which is non-interactive by design. The fix, released in version 0.2026.05.06.15.42.stable_01, canonicalizes command strings before denylist evaluation.

Business impact

For development teams using Warp as a primary development environment, this vulnerability creates supply-chain and privilege-escalation risks. If an agent processes untrusted command suggestions—whether from compromised repositories, malicious pull requests, or external integrations—an attacker could execute restricted commands like password managers, credential exporters, or destructive operations without user awareness. The non-interactive nature of the CLI agent means users may not notice unusual command execution. In shared development environments or CI/CD pipelines integrating Warp agents, this could lead to credential theft, code tampering, or lateral movement.

Affected systems

Warp versions 0.2025.10.08.08.12.stable_00 through 0.2026.05.06.15.42.stable_00 are vulnerable. The flaw specifically impacts the default unsandboxed CLI agent profile; sandboxed profiles or interactive terminal use are not affected. Users on versions prior to October 2025 or at version 0.2026.05.06.15.42.stable_01 and later are not vulnerable.

Exploitability

Exploitation requires an attacker to influence the agent's command output, making this an indirect attack vector. Realistic scenarios include: (1) a developer cloning a repository containing malicious .warp or agent-config files, (2) a compromised integration that suggests poisoned commands, or (3) a malicious code-completion suggestion from a third-party AI model. The attack does not require network access or special privileges—only the ability to shape input to the Warp agent. CVSS 8.6 (HIGH) reflects local attack surface, user interaction (opening/running commands), but high impact across confidentiality, integrity, and availability.

Remediation

Immediate action: update Warp to version 0.2026.05.06.15.42.stable_01 or later. This patch resolves the canonicalization bypass by validating commands after environment-variable resolution. Until patching is complete, disable or avoid the unsandboxed CLI agent profile if handling untrusted input; use sandboxed profiles or interactive mode instead. Review recent agent command execution logs for suspicious patterns such as unexpected environment-variable prefixes or unusual denylisted commands.

Patch guidance

Warp users should upgrade to version 0.2026.05.06.15.42.stable_01 or later. Verify availability through Warp's official download page or package manager (if applicable). Organizations using Warp in automated or CI/CD contexts should prioritize patching, as the agent runs without interactive prompts. Test the patched version in a non-production environment first to confirm compatibility with existing workflows.

Detection guidance

Monitor Warp agent execution logs (if accessible in your deployment) for commands prefixed with environment-variable assignments (e.g., commands starting with VAR=value followed by denylisted operations). Look for agent activity that appears to execute restricted commands without corresponding user confirmation. Review repositories or integrations supplying commands to the agent for signs of tampering. Consider implementing file-integrity monitoring on .warp configuration or agent-suggestion files.

Why prioritize this

This vulnerability should be prioritized for patching in the next maintenance cycle, particularly for teams integrating Warp agents into development workflows or processing untrusted input (e.g., code reviews, open-source contributions). While the attack requires indirect influence over agent input, the high CVSS score and potential for credential compromise in a development context justify expedited remediation.

Risk score, explained

CVSS 8.6 reflects: (1) Local attack vector—attacker must influence agent input on a developer's machine; (2) Low complexity—simple environment-variable prefix injection; (3) No privileges or high user interaction required; (4) High impact to confidentiality (credential leakage), integrity (code tampering), and availability (destructive commands). The unsandboxed design and non-interactive nature elevate risk, as users may not notice command execution.

Frequently asked questions