Vulnerability · Published Aug 24, 2026 · Assigned by VulnCheck
CVE-2026-76072Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode
High 7.4
In plain English
A high-severity security flaw in continue from continuedev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts hard-blocks a command only when the terminal-security evaluator returns a disabled verdict, so isCriticalCommand in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts is the sole control. Its dangerous-path test matches only /, /*, ~, ~/*, /usr, /etc, /bin and /sbin and their prefixes, so a recursive forced removal of /home, /root, /var, /opt or /srv is not disabled. The command line is parsed with shell-quote, which reduces $HOME to an empty token, so rm -rf $HOME also fails the dangerous-path test while the shell re-expands the variable when the command is spawned. find with -delete is rated high risk rather than disabled, and shred, wipefs, truncate and pkexec are not handled. Because the agent autonomously reads content it does not control, including fetched web pages, repository files and issue text, an indirect prompt injection in that content can cause an unattended run to destroy the invoking user's data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| continuedev | continue | 0 – through 1.5.47 |
Weakness: CWE-184 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
References
- https://github.com/continuedev/continue product
- https://github.com/continuedev/continue/issues/13001 issue-tracking
- https://github.com/continuedev/continue/blob/main/packages/terminal-security/src/evaluateTerminalCommandSecurity.ts technical-description
- https://www.npmjs.com/package/@continuedev/cli product
- VulnCheck Advisory: Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode third-party-advisory