Warp, an agentic development environment, contains an improper input validation vulnerability (CWE-20) in versions from 0.2025.03.05.08.02.stable_00 through 0.2026.05.06.15.42.stable_01. The issue arises because Warp accepts non-inline OSC 1337;File payloads from terminal output and materializes the decoded payload as a local file without requiring additional user confirmation. This behavior can lead to unauthorized file creation on the local system. The vulnerability is fixed starting with version 0.2026.05.06.15.42.stable_01. No known exploits in the wild have been reported. The CVSS v3.1 score is 8.8, indicating high severity.

Successful exploitation allows an attacker to cause Warp to create local files from terminal output without user confirmation, potentially leading to arbitrary file creation with confidentiality, integrity, and availability impacts rated high. This could facilitate further attacks depending on the content and location of the created files.

Upgrade Warp to version 0.2026.05.06.15.42.stable_01 or later, where this vulnerability is fixed. No other mitigation steps are indicated. Patch status is not explicitly stated as 'official-fix' or 'patchAvailable' but the description confirms the vulnerability is fixed in the stated version.