CVE-2026-48703 is an OS command injection vulnerability (CWE-78) in the Warp development environment. The flaw exists in the Agent code search tools, specifically the Grep and FileGlob actions, which are intended as read/search operations but construct shell commands from Agent-controlled inputs such as search text, paths, and glob patterns. These commands are executed in the active terminal session, allowing an attacker to bypass command execution policies. The issue affects Warp versions from 0.2025.04.09.08.11.stable_00 through versions prior to 0.2026.05.06.15.42.stable_01. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability is fixed in version 0.2026.05.06.15.42.stable_01.

Successful exploitation allows an attacker to execute arbitrary OS commands within the active terminal session, leading to full compromise of confidentiality, integrity, and availability of the affected system. This can result in unauthorized data access, modification, or disruption of service.

Upgrade Warp to version 0.2026.05.06.15.42.stable_01 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor's fixed version. Until upgraded, avoid using the vulnerable Grep and FileGlob actions with untrusted input.