Warp allows terminal output to request direct read or write operations on the local system clipboard through OSC 52 without requiring a separate confirmation step. This flaw enables a malicious remote host, remote program, or attacker‑controlled terminal output source to leak or replace clipboard contents, compromising the confidentiality and integrity of data the user expects to be securely local.

The vulnerability affects Warp versions from 0.2021.04.25.23.05.stable_00 up to, but not including, 0.2026.05.06.15.42.stable_01. Users running any of those releases on any platform can be impacted.

The CVSS score of 8.1 indicates high severity and the lack of an EPSS score means the exploitation probability is not quantified. The flaw is not listed in KEV, but its exploitation does not require special privileges, relying instead on attacker control over terminal output. An attacker who can inject terminal output into a Warp session can read or replace clipboard contents, potentially exfiltrating sensitive information or tampering with user data.