Nixpkgs security tracker

Untriaged

Permalink CVE-2026-48703

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 3 weeks ago Activity log

Created suggestion 3 weeks ago

Warp: Command Injection via Warp code search tool arguments

Warp is an agentic development environment. From 0.2025.04.09.08.11.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution policy bypass in Agent code search tools. The affected Grep and FileGlob actions are authorized as read/search operations, but their implementations build shell command strings from Agent-controlled inputs (search text, paths, glob patterns) and execute them in the active terminal session. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.

References

https://github.com/warpdotdev/warp/security/advisories/GHSA-8r78-7jwh-m6hm x_refsource_CONFIRM
https://github.com/warpdotdev/warp/commit/43f4f483e0c2dd253d2aaa8a495b2d71f0208c40 x_refsource_MISC

Affected products

warp

==>= 0.2025.04.09.08.11.stable_00, < 0.2026.05.13.09.15.stable_01

Matching in nixpkgs

pkgs.warp

Fast and secure file transfer

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.warpd

Modal keyboard driven interface for mouse manipulation

nixos-unstable 1.3.5
- nixpkgs-unstable 1.3.5
- nixos-unstable-small 1.3.5
nixos-26.05 1.3.5
- nixos-26.05-small 1.3.5
- nixpkgs-26.05-darwin 1.3.5

pkgs.ts-warp

Transparent proxy server and traffic wrapper

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

pkgs.warpgate

Smart SSH, HTTPS, MySQL and Postgres bastion that requires no additional client-side software

nixos-unstable 0.23.4
- nixpkgs-unstable 0.23.4
- nixos-unstable-small 0.23.4
nixos-26.05 0.23.4
- nixos-26.05-small 0.23.4
- nixpkgs-26.05-darwin 0.23.4

pkgs.warp-plus

None

pkgs.minio-warp

S3 benchmarking tool

nixos-unstable 1.5.0
- nixpkgs-unstable 1.5.0
- nixos-unstable-small 1.5.0
nixos-26.05 1.5.0
- nixos-26.05-small 1.5.0
- nixpkgs-26.05-darwin 1.5.0

pkgs.warpinator

Share files across the LAN

nixos-unstable 2.0.4
- nixpkgs-unstable 2.0.4
- nixos-unstable-small 2.0.4
nixos-26.05 2.0.4
- nixos-26.05-small 2.0.4
- nixpkgs-26.05-darwin 2.0.4

pkgs.git-warp-time

Utility to reset filesystem timestamps based on Git history

nixos-unstable 0.8.5
- nixpkgs-unstable 0.8.5
- nixos-unstable-small 0.8.5
nixos-26.05 0.8.5
- nixos-26.05-small 0.8.5
- nixpkgs-26.05-darwin 0.8.5

pkgs.warp-terminal

Rust-based terminal

nixos-unstable 0.2026.04.15.08.45.stable_04
- nixpkgs-unstable 0.2026.04.15.08.45.stable_04
- nixos-unstable-small 0.2026.06.03.09.49.stable_01
nixos-26.05 0.2026.04.15.08.45.stable_04
- nixos-26.05-small 0.2026.04.15.08.45.stable_04
- nixpkgs-26.05-darwin 0.2026.04.15.08.45.stable_04

pkgs.cloudflare-warp

Replaces the connection between your device and the Internet with a modern, optimized, protocol

nixos-unstable 2026.3.846.0
- nixpkgs-unstable 2026.3.846.0
- nixos-unstable-small 2026.3.846.0
nixos-26.05 2026.3.846.0
- nixos-26.05-small 2026.3.846.0
- nixpkgs-26.05-darwin 2026.3.846.0

pkgs.haskellPackages.warp

A fast, light-weight web server for WAI applications

nixos-unstable 3.4.9
- nixpkgs-unstable 3.4.9
- nixos-unstable-small 3.4.9
nixos-26.05 3.4.9
- nixos-26.05-small 3.4.9
- nixpkgs-26.05-darwin 3.4.9

pkgs.haskellPackages.warp-tls

HTTP over TLS support for Warp via the TLS package

nixos-unstable 3.4.14
- nixpkgs-unstable 3.4.14
- nixos-unstable-small 3.4.14
nixos-26.05 3.4.14
- nixos-26.05-small 3.4.14
- nixpkgs-26.05-darwin 3.4.14

pkgs.gnomeExtensions.warpgnome

Toggle Cloudflare WARP in quick settings.

nixos-unstable 2
- nixpkgs-unstable 2
- nixos-unstable-small 2
nixos-26.05 2
- nixos-26.05-small 2
- nixpkgs-26.05-darwin 2

pkgs.gnomeExtensions.mouse-warp

Moves the mouse cursor to the center of the focused window on focus change.

nixos-unstable 2
- nixpkgs-unstable 2
- nixos-unstable-small 2
nixos-26.05 2
- nixos-26.05-small 2
- nixpkgs-26.05-darwin 2

pkgs.gnomeExtensions.warp-toggle

Toggle Cloudflare WARP connection from Quick Settings menu

nixos-unstable 9
- nixpkgs-unstable 9
- nixos-unstable-small 9
nixos-26.05 9
- nixos-26.05-small 9
- nixpkgs-26.05-darwin 9

pkgs.python312Packages.warp-lang

None

pkgs.python313Packages.warp-lang

Python framework for high performance GPU simulation and graphics

nixos-unstable 1.11.0
- nixpkgs-unstable 1.11.0
- nixos-unstable-small 1.11.0
nixos-26.05 1.11.0
- nixos-26.05-small 1.11.0
- nixpkgs-26.05-darwin 1.11.0

pkgs.python314Packages.warp-lang

Python framework for high performance GPU simulation and graphics

nixos-unstable 1.11.0
- nixpkgs-unstable 1.11.0
- nixos-unstable-small 1.11.0
nixos-26.05 1.11.0
- nixos-26.05-small 1.11.0
- nixpkgs-26.05-darwin 1.11.0

pkgs.haskellPackages.jsaddle-warp

Interface for JavaScript that works with GHCJS and GHC

nixos-unstable 0.9.9.6
- nixpkgs-unstable 0.9.9.6
- nixos-unstable-small 0.9.9.6
nixos-26.05 0.9.9.6
- nixos-26.05-small 0.9.9.6
- nixpkgs-26.05-darwin 0.9.9.6

pkgs.haskellPackages.warp-systemd

Socket activation and other systemd integration for the Warp web server (WAI)

nixos-unstable 0.3.0.0
- nixpkgs-unstable 0.3.0.0
- nixos-unstable-small 0.3.0.0
nixos-26.05 0.3.0.0
- nixos-26.05-small 0.3.0.0
- nixpkgs-26.05-darwin 0.3.0.0

pkgs.haskellPackages.core-webserver-warp

Interoperability with Wai/Warp

nixos-unstable 0.2.1.2
- nixpkgs-unstable 0.2.1.2
- nixos-unstable-small 0.2.1.2
nixos-26.05 0.2.1.2
- nixos-26.05-small 0.2.1.2
- nixpkgs-26.05-darwin 0.2.1.2

pkgs.gnomeExtensions.cloudflare-warp-toggle

Toggle cloudflare warp in quick settings.

nixos-unstable 21
- nixpkgs-unstable 21
- nixos-unstable-small 21
nixos-26.05 21
- nixos-26.05-small 21
- nixpkgs-26.05-darwin 21

pkgs.gnomeExtensions.cloudflare-warp-indicator

System tray indicator and controls for Cloudflare WARP VPN. Shows connection status, info panel, and connect/disconnect toggle via warp-cli.

nixos-unstable 1
- nixpkgs-unstable 1
- nixos-unstable-small 1
nixos-26.05 1
- nixos-26.05-small 1
- nixpkgs-26.05-darwin 1

pkgs.haskellPackages.essence-of-live-coding-warp

General purpose live coding framework

nixos-unstable 0.2.9
- nixpkgs-unstable 0.2.9
- nixos-unstable-small 0.2.9
nixos-26.05 0.2.9
- nixos-26.05-small 0.2.9
- nixpkgs-26.05-darwin 0.2.9

Package maintainers

@marcusramberg Marcus Ramberg <marcus@means.no>
@ap-1 Anish Pallati <i@anish.land>
@alerque Caleb Maclennan <caleb@alerque.com>
@honnip Jung seungwoo <me@honnip.page>
@turion Manuel Bärenz <programming@manuelbaerenz.de>
@alexfmpe Alexandre Esteves <alexfmpe@proton.me>
@maralorn maralorn <mail@maralorn.de>
@mpscholten Marc Scholten <marc@digitallyinduced.com>
@christoph-heiss Christoph Heiss <christoph@c8h4.io>
@yzx9 Zexin Yuan <yuan.zx@outlook.com>
@heywoodlh Spencer Heywood <nixpkgs@heywoodlh.io>
@michaelgrahamevans Michael Evans <michaelgrahamevans@gmail.com>
@Aleksanaa Aleksana QwQ <me@aleksana.moe>
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
@getchoo Seth Flynn <getchoo@tuta.io>
@i-am-logger Ido Samuelson <ido.samuelson@gmail.com>
@FlameFlag FlameFlag <github@flameflag.dev>
@imadnyc Abdullah Imad <me@imad.nyc>
@johnrtitor Masum Reza <masumrezarock100@gmail.com>
@hcur hhydraa <hcurfman@keemail.me>
@alemonmk Lemon Lam <almk@rmntn.net>
@bobby285271 Bobby Rong <rjl931189261@126.com>
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>

Suggestion detail