Warp, an agentic development environment, contains an improper input validation vulnerability (CWE-20) where it accepts non-inline OSC 1337;File payloads from terminal output and materializes the decoded payload as a local file without requiring additional user confirmation. This behavior occurs in versions from 0.2025.03.05.08.02.stable_00 through 0.2026.05.06.15.42.stable_01 (exclusive). The vulnerability is addressed in version 0.2026.05.06.15.42.stable_01. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

An attacker can cause Warp to create local files from terminal output without user confirmation, potentially leading to arbitrary file creation on the local system. This can compromise confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 8.8.

A fix is available in Warp version 0.2026.05.06.15.42.stable_01. Users should upgrade to this version or later to remediate the vulnerability. No additional mitigation guidance is provided.