The vulnerability lies in Warp’s Agent code search tools (Grep and FileGlob). The implementation builds shell command strings from Agent‑controlled inputs such as search text, paths and glob patterns, and executes them in the active terminal session. Because the actions are authorized as read/search operations, an attacker can inject arbitrary shell commands via crafted arguments and gain the ability to execute arbitrary code with the permissions of the running Agent process. This weakness is classified under CWE‑78 and carries a CVSS score of 7.8, indicating a high‑severity risk of compromise.

Warp (warp dot dev: warp) versions from 0.2025.04.09.08.11.stable_00 up through 0.2026.05.06.15.42.stable_01 are susceptible. The issue persists in releases released before 0.2026.05.06.15.42.stable_01 and is fixed in that version and later.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread exploitation has been observed at this time. Based on the description, the likely attack vector involves an authenticated user wielding the Agent’s search functions to supply crafted arguments that are executed as shell commands. Successful exploitation would allow the attacker to run any command with the privilege level of the Agent, potentially leading to privilege escalation and full system compromise.