Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M
CVE-2026-54699Warp: OS command injection when opening terminal links from WSL
High 7.7
In plain English
A high-severity OS command injection in warp from warpdotdev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Official description
Warp is an agentic development environment. From 0.2024.03.12.08.02.stable_01 until 0.2026.05.06.15.42.stable_01, Warp contains an OS command injection vulnerability in the WSL URL-opening fallback. When Warp is running under WSL and cannot open a URL through wslview, it falls back to a Windows command processor path. A URL controlled through terminal output can reach that fallback when the user opens the link. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| warpdotdev | warp | >= 0.2024.03.12.08.02.stable_01, < 0.2026.05.13.09.15.stable_01 |
Weakness: CWE-78, CWE-116 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H