CVE-2026-48732 is an OS command injection vulnerability (CWE-78) in the Warp development environment affecting versions from 0.2023.03.21.08.02.stable_00 up to 0.2026.05.06.15.42.stable_01. The issue arises in the legacy SSH background command path where Warp uses the remote working directory reported by the SSH session to build helper commands for metadata collection. If an attacker controls the remote host, repository, or directory name, they can inject arbitrary shell syntax, causing execution of unintended commands on the remote host under the victim's authenticated SSH account. This can lead to full compromise of the remote system. The vulnerability is resolved in version 0.2026.05.06.15.42.stable_01.

Successful exploitation allows an attacker to execute arbitrary shell commands on the remote host with the privileges of the victim's authenticated SSH account. This can lead to full compromise of the remote system, including confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 8.8 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

A fix is available in Warp version 0.2026.05.06.15.42.stable_01. Users should upgrade to this version or later to remediate the vulnerability. No official temporary workaround or mitigation is documented. Patch status is confirmed by the vendor advisory stating the issue is fixed in 0.2026.05.06.15.42.stable_01.