Vulnerability Intelligence Report
Warp Markdown notebook links may open executable local files
CVE-2026-48704
Warp is an agentic development environment. From 0.2023.10.24.08.03.stable_00 until 0.2026.05.06.15.42.stable_01, Warp may open executable local files through the operating system default file handler. A malicious Markdown document or project can contain a local-file link that appears as normal rendered content. If a user opens the Markdown in Warp and clicks the link, affected builds may route the resolved local file to a platform file opener instead of limiting the action to safe viewer/editor targets. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
No Active Exploit Signals
CVSS Base Score
8.8
HIGH
Exploitability:2.9
Impact Score:5.9
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-20 ↗CWE-20: Improper Input Validation
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| warpdotdev | warp | >= 0.2023.10.24.08.03.stable_00, < 0.2026.05.13.09.15.stable_01 (affected) |
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitHub, Inc. · Vendor · USA |
| Reserved | 2026-05-22T18:47:27 |
| Published | 2026-06-24T17:35:02 |
| Last Updated | 2026-06-24T17:57:45 |
Community Chatter & Buzz