Unrated

Warp Markdown local-file link opens executable files via OS handler

IdentifiersCVE-2026-48704CWE-829

CVE-2026-48704 is a vulnerability in Warp's Markdown notebook link handling. In affected versions from 0.2023.10.24.08.03.stable_00 up to, but not including, 0.2026.05.06.15.42.stable_01, a malicious Markdown document or project can embed a local-file link that appears as normal rendered content. When a user opens the attacker-controlled Markdown in Warp and clicks the rendered link, Warp may pass the resolved local file to the operating system's default file handler instead of restricting the action to safe viewer or editor targets. If the referenced local file is executable and exists in a location controlled or influenced by the attacker, this can result in execution of that file. Warp states the issue affects macOS and Windows, and may affect Linux depending on desktop environment and file-handler configuration.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation may lead to arbitrary code execution in the security context of the logged-in Warp user. Because the file is opened through the platform default handler, the practical impact includes execution of attacker-controlled local executables, with resulting confidentiality, integrity, and availability impact equivalent to code execution as that user. Warp confirmed impact on macOS and Windows; Linux impact is conditional on local desktop and handler behavior.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, avoid opening Markdown documents or projects from untrusted sources in Warp, and do not click rendered local-file links in untrusted Markdown content. Where feasible, harden operating-system file-handler associations and desktop execution behavior to reduce the chance that opening a local file will directly launch executable content.

Remediation

Patch, then assume compromise.

Upgrade Warp to version 0.2026.05.06.15.42.stable_01 or later. According to the vendor, the fix changes local-link handling so unsafe local files are revealed in the file manager rather than opened through the system default handler, while preserving safe viewer/editor behavior.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

cvefeed high severityNews

Jun 24, 2026

CVE-2026-48704 - Warp Markdown notebook links may open executable local files

A vulnerability in Warp where malicious Markdown or project content can include local-file links that, when clicked, may open executable local files via the OS default file handler.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-48704

NVD

nvd.nist.gov/vuln/detail/CVE-2026-48704

MITRE CWE · CWE-829

cwe.mitre.org