Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-48704: Warp may launch local programs when clicking Markdown links
CVE-2026-48704 · published 4 months ago
Summary
Warp versions from early 2023 through early May 2026 can open executable files on your computer when you click a link inside a Markdown document. A crafted document could make it look like a harmless link but actually start a program on the system. Update Warp to the version released after May 6, 2026 to stop this behavior.
Original advisory text
Warp Markdown notebook links may open executable local files
Warp is an agentic development environment. From 0.2023.10.24.08.03.stable_00 until 0.2026.05.06.15.42.stable_01, Warp may open executable local files through the operating system default file handler. A malicious Markdown document or project can contain a local-file link that appears as normal rendered content. If a user opens the Markdown in Warp and clicks the link, affected builds may route the resolved local file to a platform file opener instead of limiting the action to safe viewer/editor targets. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
References
- https://github.com/warpdotdev/warp/security/advisories/GHSA-589x-4mxh-jcrf Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48704... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-48704 Vendor Advisory
- https://github.com/warpdotdev/warp/commit/7f0c4dd2322198f1b39890f8e6bcdc606c6a3c... Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-20Improper Input Validation
Timeline
Published24 Jun 2026
Updated4 Nov 2026
First seen24 Jun 2026
Track software like this
Free during beta