low
advisory
Warp Terminal Emulator: DCS Lifecycle Hook Spoofing (CVE-2026-54686)
Warp terminal emulator is vulnerable to a DCS lifecycle hook spoofing issue. The application fails to verify the authenticity of state-mutating lifecycle hooks transmitted via the PTY stream, allowing an attacker to spoof Current Working Directory (CWD) and SSH session transport metadata if a user views attacker-controlled terminal output.
CVE search metadata
CVE search record: CVE-2026-54686. Severity: medium. CVSS: 4.3. EPSS: 0.40%. KEV: no. Product: Warp (< 0.2026.05.06.15.42.stable_01). Brief: Warp Terminal Emulator: DCS Lifecycle Hook Spoofing (CVE-2026-54686). Brief link: https://feed.craftedsignal.io/briefs/2026-10-warp-dcs-spoofing/
Triage facts
Revision 1- Applicability
- Warp (< 0.2026.05.06.15.42.stable_01)
- Evidence
- Not observed
- Severity
- Low
- Sources
- 4 public sources
- Freshness
- Revision 1Oct 25, 03:41 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance