Continue CLI through 1.5.47: two unpatched CVEs let prompt-injected text run or destroy files without approval

Vulnerability · Continue CLI (@continuedev/cli) · HIGH

Incident dateNot stated

DisclosedCVE-2026-76072: Aug 24, 2026 (VulnCheck/NVD; GHSA-xqr4-4xjv-5j7q). CVE-2026-109560: Oct 12, 2026 (VulnCheck/NVD; GHSA-f54m-g39v-qf2p). No patched version listed as of Oct 16, 2026; npm latest still 1.5.47.

Added hereOct 16, 8:15 AM ET

Last verifiedOct 16, 2026

Summary

Two CVEs filed by VulnCheck cover the Continue CLI (@continuedev/cli) through version 1.5.47, the latest release on npm as of Oct 16, 2026, and neither lists a fix. CVE-2026-109560, published Oct 12, 2026, says text planted in repository files or fetched pages can get the agent to add commands after ;, && or | to a command that matches an allowed Bash prefix rule, so they run as the user. CVE-2026-76072, published Aug 24, 2026, says that in headless and auto mode the CLI's only barrier to destructive shell commands is an incomplete denylist that misses, for example, rm -rf on /home, /root, /var, /opt or /srv, rm -rf $HOME, shred, wipefs and truncate. VulnCheck rates them CVSS 4.0 7.7 and 8.3 High. Both GitHub issues (#13288 and #13001) are still open, and two community fix pull requests were closed without being merged. These CVEs name the Continue CLI only; the Continue VS Code and JetBrains extensions are separate products.

Severity

HIGH High (VibeIncidents editorial rating). VulnCheck scores CVE-2026-109560 CVSS 4.0 7.7 and CVE-2026-76072 CVSS 4.0 8.3. GitHub Advisory Database lists matching GHSAs as high (CVSS 3.1 7.5 and 7.4) but unreviewed, with no patched version. npm latest remains 1.5.47 (published Jun 18, 2026). No exploitation reported. Fair note: we have not seen a Continue maintainer statement; open issues and closed community PRs are the public status signal.

Timeline

Jun 18, 2026
@continuedev/cli 1.5.47 published on npm; it remains the latest dist-tag as of Oct 16, 2026.
Aug 12, 2026
Community fix pull request #13006 (destructive-command denylist) is closed without being merged.
Aug 24, 2026
VulnCheck / NVD publish CVE-2026-76072 (incomplete destructive-command denylist in headless/auto mode); GHSA-xqr4-4xjv-5j7q appears in the GitHub Advisory Database.
Oct 1, 2026
Community fix pull request #13008 (Bash permission chaining) is closed without being merged.
Oct 5, 2026
GitHub issues #13288 and #13001 still open (last activity this date as of our Oct 16 check).
Oct 12, 2026
VulnCheck / NVD publish CVE-2026-109560 (Bash permission-rule bypass via command chaining); GHSA-f54m-g39v-qf2p appears in the GitHub Advisory Database.
Oct 16, 2026
npm latest still 1.5.47; both GHSAs still unreviewed with empty vulnerabilities lists; no patched version listed.

How it happened

CVE-2026-109560 (CWE-863): per VulnCheck and NVD, the CLI approves a Bash command that matches an allowed prefix rule without checking anything chained after ;, && or |. Attackers plant instructions in repository files or fetched pages so the agent appends a second command that then runs as the user. VulnCheck points at permissionChecker.ts and policyWriter.ts. CVE-2026-76072 (CWE-184): in headless and auto mode the default policy gives the Bash tool allow, and a command is hard-blocked only when the terminal-security evaluator returns disabled. Its dangerous-path test covers only /, /*, ~, ~/*, /usr, /etc, /bin and /sbin; shell-quote parsing can turn $HOME into an empty token that the shell later expands; find -delete is rated high risk rather than disabled; and shred, wipefs, truncate and pkexec are not handled. GitHub's advisory database lists both GHSAs as unreviewed with no patched version. Credit: VulnCheck names Akıner Kısa and Tardfyou for CVE-2026-109560 and George Chen for CVE-2026-76072.

How to check your app

Check which @continuedev/cli version you have (npm list -g @continuedev/cli or the local package). 1.5.47 and earlier are in scope, and there is no newer release listed.
Avoid headless or auto mode on content you do not control: untrusted repositories, issues or web pages.
Do not rely on Bash prefix allow rules alone; a chained command after ;, && or | is not checked under CVE-2026-109560.
Run the CLI in a container or under a separate low-privilege account so a destructive command cannot reach your home directory.
Watch continuedev/continue issues #13288 and #13001 and the npm latest tag for a release after 1.5.47.

Sources

Corrections and updates

None. Re-checked against every source on Oct 16, 2026.