CVE-2026-54686

Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepted certain state-mutating terminal lifecycle hooks from the PTY stream without verifying that the hooks were emitted by Warp's shell integration for the active session. An attacker who could cause a victim to view attacker-controlled terminal output in Warp could spoof selected lifecycle metadata, including the current working directory reported for the active block or SSH session transport metadata. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.

• CWE-78
• CWE-88

• https://github.com/warpdotdev/warp/commit/32d21d15c9a3da1a923d1ed66226cf5cba081d16
• https://github.com/warpdotdev/warp/commit/51bd3267803c5cc0a45074fa19fd50162be7c917
• https://github.com/warpdotdev/warp/security/advisories/GHSA-9w2v-jhww-vm85

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54673electron-updater allows for automatic updates for Electron a…8.2
• CVE-2026-54679jq is a command-line JSON processor. Prior to 1.8.2, on 32bi…5.5
• CVE-2026-5468A security flaw has been discovered in Casdoor 2.356.0. This…5.4
• CVE-2026-54680Logging operator automates the deployment and configuration …9.9
• CVE-2026-54684jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a mal…7
• CVE-2026-54685FileBrowser Quantum is a free, self-hosted, web-based file m…5.3
• CVE-2026-5469A weakness has been identified in Casdoor 2.356.0. This vuln…7.2
• CVE-2026-54690datamodel-code-generator generates Pydantic v2 models, datac…8.2
• CVE-2026-54691datamodel-code-generator generates Python data models from s…8.2
• CVE-2026-54693ZITADEL is an open source identity management platform. From…8.2
• CVE-2026-54695Pipecat is an open-source Python framework for building real…6.5
• CVE-2026-54696Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 …3.7