Warp CLI Agent Command Execution Bypass via Env-var Prefixes (CVE-2026-48721)

Vulnerability Overview Vulnerability Name: Env-var prefixes can lead to denylisted command autoexecution Vulnerability ID: GHSA-3839-h8jp-ph82 CVE ID: CVE-2026-48721 Severity: 8.6 / 10 (High) CVSS v3 base metrics: - Attack vector: Local - Attack complexity: Low - Privileges required: None - User interaction: Required - Scope: Changed - Confidentiality: High - Integrity: High - Availability: High Scope Affected Versions: >=v0.2025.10.08.08.12.stable_0 Fixed Versions: v0.2026.05.06.15.42.stable_01 Description: Affected versions of Warp have a command execution permission check bypass in the default unsandboxed CLI agent configuration. The CLI agent is non-interactive and relies on a command denylist as a security boundary for commands that require confirmation. Because the command string normalizes leading environment variable assignments before the check, an attacker can influence the agent's command output, causing denylisted commands to be treated as non-denylisted. Impact: Successful exploitation may allow commands requiring confirmation to run under the local shell permissions of the victim user. Exploitation requires user interaction: the victim must run the unsandboxed CLI agent in a context controlled or prompted for injection by the attacker, or receive a malicious agent response. Remediation Patch: The patch normalizes the command for denylist evaluation by stripping leading environment variable assignments before the execution predicate is applied. Workaround: If an immediate update is not possible, avoid running the unsandboxed CLI agent on untrusted or prompt-injected content. References GHSA-3839-h8jp-ph82 CVE-2026-48721 Fix Commit: 0c1e243792c642f9a7748f808136dfbf0b31dde Patch Release: v0.2026.05.06.15.42.stable_01 Credits Reporter: Cantina's AppSec agent, Apex (https://www.cantina.security/) Additional Information Author: Legobean Release Date: 2 weeks ago Platform: GitHub Repository: warpdotdev/warp

Goal Reached Thanks to every supporter — we hit 100%!

Warp CLI Agent Command Execution Bypass via Env-var Prefixes (CVE-2026-48721)

More from this source