Warp Terminal RCE via SSH Metadata Injection (CVE-2026-48732)

Vulnerability Overview Vulnerability Name: Remote SSH cwd can lead to unauthorized remote command execution Vulnerability ID: GHSA-qgpc-www-4269 Publication Date: August 2, 2023 Severity: High (CVSS v3 base metrics: 8.8 / 10) Affected Range Affected Versions: - Warp >= v0.2023.03.21.08.02.stable_0 - Warp < v0.2026.05.06.15.42.stable_0 Vulnerability Description: - A command injection vulnerability exists in affected Warp versions within the legacy SSH background command path. Warp uses the remote working directory reported by the session as the directory for SSH auxiliary metadata collection. Attackers can control the remote host, repository, or directory names, thereby injecting additional shell syntax for execution on the victim's authenticated SSH account. Impact: - Successful exploitation may allow attacker-controlled commands to run on the connected remote host with the permissions of the victim's SSH account. This could lead to the exposure, modification, or disruption of files and processes accessible to the account. Exploitation requires the victim to use an affected legacy SSH session and reach a state with an attacker-controlled remote working directory. Remediation Patch: - The patch escapes embedded single quotes in the remote working directory before constructing the legacy SSH auxiliary commands. - A link to the public fix commit will be added upon the release of the announcement. Workaround: - No workaround is available other than updating. Additional Information CVE ID: CVE-2026-48732 Weakness: CWE-78 Reporters: - @christos-spearbit - @Saku0512 References GHSA-qgpc-www-4269 CVE-2026-48732 Fix Commit Patch Release Code Block No POC or exploit code provided.

Goal Reached Thanks to every supporter — we hit 100%!

Warp Terminal RCE via SSH Metadata Injection (CVE-2026-48732)

More from this source