CVE-2026-48704CWE-20

Warp Markdown notebook links may open executable local files

High · published June 24, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
37.4
In the wild
Unconfirmed
What it is

Warp is an agentic development environment. From 0.2023.10.24.08.03.stable_00 until 0.2026.05.06.15.42.stable_01, Warp may open executable local files through the operating system default file handler. A malicious Markdown document or project can contain a local-file link that appears as normal rendered content. If a user opens the Markdown in Warp and clicks the link, affected builds may route the resolved local file to a platform file opener instead of limiting the action to safe viewer/editor targets. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00442 · 37.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-06-24T17:35Z
EPSS history
Timeline
  • 24 JUN 17:35Z
    Warp Markdown notebook links may open executable local files
    cvelistv5