CVE-2026-54686

{
  "id": "CVE-2026-54686",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-24T18:17:19.067",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepted certain state-mutating terminal lifecycle hooks from the PTY stream without verifying that the hooks were emitted by Warp's shell integration for the active session. An attacker who could cause a victim to view attacker-controlled terminal output in Warp could spoof selected lifecycle metadata, including the current working directory reported for the active block or SSH session transport metadata. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01."
    },
    {
      "lang": "es",
      "value": "Warp es un entorno de desarrollo agéntico. Desde 0.2021.04.25.23.05.stable_00 hasta 0.2026.05.06.15.42.stable_01, Warp aceptó ciertos ganchos de ciclo de vida de terminal que mutan el estado desde el flujo PTY sin verificar que los ganchos fueran emitidos por la integración de shell de Warp para la sesión activa. Un atacante que pudiera hacer que una víctima viera la salida de terminal controlada por el atacante en Warp podría falsificar metadatos de ciclo de vida seleccionados, incluyendo el directorio de trabajo actual reportado para el bloque activo o metadatos de transporte de sesión SSH. Esta vulnerabilidad está corregida en 0.2026.05.06.15.42.stable_01."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "warpdotdev",
          "product": "warp",
          "versions": [
            {
              "version": ">= 0.2021.04.25.23.05.stable_00, < 0.2026.05.13.09.15.stable_01",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-25T17:04:59.234400Z",
          "id": "CVE-2026-54686",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        },
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/warpdotdev/warp/commit/32d21d15c9a3da1a923d1ed66226cf5cba081d16",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/warpdotdev/warp/commit/51bd3267803c5cc0a45074fa19fd50162be7c917",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/warpdotdev/warp/security/advisories/GHSA-9w2v-jhww-vm85",
      "source": "[email protected]"
    }
  ]
}