CVE-2026-54686
MEDIUMWarp: DCS lifecycle hook spoofing can alter terminal session metadata
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-54686. PoCs published by Saku0512.
AI-analyzed exploit summary This repository contains a functional local Proof of Concept for CVE-2026-54686, demonstrating how Warp DCS lifecycle hook spoofing can alter terminal session metadata. The PoC simulates both vulnerable and fixed models to show the impact of missing session-ID integrity checks.
Description
Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepted certain state-mutating terminal lifecycle hooks from the PTY stream without verifying that the hooks were emitted by Warp's shell integration for the active session. An attacker who could cause a victim to view attacker-controlled terminal output in Warp could spoof selected lifecycle metadata, including the current working directory reported for the active block or SSH session transport metadata. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
Exploits (1)
This repository contains a functional local Proof of Concept for CVE-2026-54686, demonstrating how Warp DCS lifecycle hook spoofing can alter terminal session metadata. The PoC simulates both vulnerable and fixed models to show the impact of missing session-ID integrity checks.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L