CVE-2026-48721

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48721", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-22T18:47:27.756Z", "datePublished": "2026-06-24T17:31:15.365Z", "dateUpdated": "2026-06-25T17:06:14.638Z"}, "containers": {"cna": {"title": "Warp: Env-var prefixes can lead to denylisted command autoexecution", "problemTypes": [{"descriptions": [{"cweId": "CWE-180", "lang": "en", "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-693", "lang": "en", "description": "CWE-693: Protection Mechanism Failure", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/warpdotdev/warp/security/advisories/GHSA-3839-h8jj-ph82", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/warpdotdev/warp/security/advisories/GHSA-3839-h8jj-ph82"}, {"name": "https://github.com/warpdotdev/warp/commit/0c1e243292c642d9a7748f80813b6fdfc0b31a9e", "tags": ["x_refsource_MISC"], "url": "https://github.com/warpdotdev/warp/commit/0c1e243292c642d9a7748f80813b6fdfc0b31a9e"}], "affected": [{"vendor": "warpdotdev", "product": "warp", "versions": [{"version": ">= 0.2025.10.08.08.12.stable_00, < 0.2026.05.13.09.15.stable_01", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-24T17:31:15.365Z"}, "descriptions": [{"lang": "en", "value": "Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety boundary for commands that should require confirmation. Because command strings were checked before canonicalizing leading environment-variable assignments, an attacker who can influence the agent's command output may cause denylisted commands to be treated as non-denylisted. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01."}], "source": {"advisory": "GHSA-3839-h8jj-ph82", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-25T17:06:00.971042Z", "id": "CVE-2026-48721", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T17:06:14.638Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48721", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-25T17:06:00.971042Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T17:06:10.553Z"}}], "cna": {"title": "Warp: Env-var prefixes can lead to denylisted command autoexecution", "source": {"advisory": "GHSA-3839-h8jj-ph82", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "warpdotdev", "product": "warp", "versions": [{"status": "affected", "version": ">= 0.2025.10.08.08.12.stable_00, < 0.2026.05.13.09.15.stable_01"}]}], "references": [{"url": "https://github.com/warpdotdev/warp/security/advisories/GHSA-3839-h8jj-ph82", "name": "https://github.com/warpdotdev/warp/security/advisories/GHSA-3839-h8jj-ph82", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/warpdotdev/warp/commit/0c1e243292c642d9a7748f80813b6fdfc0b31a9e", "name": "https://github.com/warpdotdev/warp/commit/0c1e243292c642d9a7748f80813b6fdfc0b31a9e", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety boundary for commands that should require confirmation. Because command strings were checked before canonicalizing leading environment-variable assignments, an attacker who can influence the agent's command output may cause denylisted commands to be treated as non-denylisted. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-180", "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-24T17:31:15.365Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48721", "state": "PUBLISHED", "dateUpdated": "2026-06-25T17:06:14.638Z", "dateReserved": "2026-05-22T18:47:27.756Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-24T17:31:15.365Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "warp", "vendor": "warpdotdev", "versions": [{"status": "affected", "version": ">= 0.2025.10.08.08.12.stable_00, < 0.2026.05.13.09.15.stable_01"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety boundary for commands that should require confirmation. Because command strings were checked before canonicalizing leading environment-variable assignments, an attacker who can influence the agent's command output may cause denylisted commands to be treated as non-denylisted. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01."}, {"lang": "es", "value": "Warp es un entorno de desarrollo ag\u00e9ntico. Desde 0.2025.10.08.08.12.stable_00 hasta 0.2026.05.06.15.42.stable_01, Warp contiene un bypass de verificaci\u00f3n de permisos de ejecuci\u00f3n de comandos en el perfil de agente CLI predeterminado sin sandbox. El perfil CLI no es interactivo y se basa en una lista negra de comandos como l\u00edmite de seguridad para los comandos que deber\u00edan requerir confirmaci\u00f3n. Debido a que las cadenas de comandos se verificaban antes de canonicalizar las asignaciones de variables de entorno iniciales, un atacante que puede influir en la salida de comandos del agente puede hacer que los comandos en la lista negra sean tratados como no en la lista negra. Esta vulnerabilidad est\u00e1 corregida en 0.2026.05.06.15.42.stable_01."}], "id": "CVE-2026-48721", "lastModified": "2026-10-25T22:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48721", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-25T17:06:00.971042Z", "version": "2.0.3"}}]}, "published": "2026-06-24T18:17:18.283", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/warpdotdev/warp/commit/0c1e243292c642d9a7748f80813b6fdfc0b31a9e"}, {"source": "security-advisories@github.com", "url": "https://github.com/warpdotdev/warp/security/advisories/GHSA-3839-h8jj-ph82"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-180"}, {"lang": "en", "value": "CWE-693"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0.2025.10.08.08.12.stable_00,0.2026.05.13.09.15.stable_01)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "warp", "source": "cna", "vendor": "warpdotdev"}, "product": "warp", "vendor": "warpdotdev"}], "created": "2026-06-24T20:45:03.357721+00:00", "updated": "2026-06-26T09:40:36.348687+00:00", "vendors": ["warpdotdev", "warpdotdev$PRODUCT$warp"]}