CVE-2026-48725 is an incorrect default permissions vulnerability (CWE-276) in the Warp agentic development environment. Specifically, terminal output can request access to the local system clipboard without requiring explicit user confirmation, allowing attacker-controlled terminal output to perform clipboard reads or writes. This vulnerability affects Warp versions starting from 0.2021.04.25.23.05.stable_00 up to but excluding 0.2026.05.06.15.42.stable_01. The vulnerability is resolved in version 0.2026.05.06.15.42.stable_01.

An attacker controlling terminal output can read from or write to the user's local clipboard without additional user interaction, potentially leading to unauthorized disclosure or modification of clipboard data. This crosses the trust boundary between untrusted terminal output and the local desktop environment, impacting confidentiality and integrity. Availability is not affected. The CVSS score is 8.1 (high severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impact.

A fix is available in Warp version 0.2026.05.06.15.42.stable_01. Users should upgrade to this version or later to remediate the vulnerability. No vendor advisory content is provided to indicate alternative mitigations or temporary workarounds. Patch status is confirmed by the version fix information in the description.