CVE-2026-76072
Received Received - Intake

Continue CLI Remote Code Execution via Incomplete Denylist

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts hard-blocks a command only when the terminal-security evaluator returns a disabled verdict, so isCriticalCommand in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts is the sole control. Its dangerous-path test matches only /, /*, ~, ~/*, /usr, /etc, /bin and /sbin and their prefixes, so a recursive forced removal of /home, /root, /var, /opt or /srv is not disabled. The command line is parsed with shell-quote, which reduces $HOME to an empty token, so rm -rf $HOME also fails the dangerous-path test while the shell re-expands the variable when the command is spawned. find with -delete is rated high risk rather than disabled, and shred, wipefs, truncate and pkexec are not handled. Because the agent autonomously reads content it does not control, including fetched web pages, repository files and issue text, an indirect prompt injection in that content can cause an unattended run to destroy the invoking user's data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-76072
EUVD
EUVD-2026-65059

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
continue_dev_inc continue_cli 1.5.47
continue_dev_inc continue_cli to 1.5.48 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76072 is a vulnerability in the Continue CLI where the denylist for destructive shell commands is incomplete. In headless or auto modes, the default policy allows Bash commands, relying only on a terminal-security evaluator to block dangerous commands. The blocklist misses critical paths like /home, /root, /var, /opt, and /srv, and fails to handle commands like rm -rf $HOME, find -delete, shred, wipefs, truncate, and pkexec. This allows indirect prompt injection attacks to trigger irreversible data loss without user prompts.

Detection Guidance

Check for unauthorized execution of destructive commands in Continue CLI logs or system audit trails. Monitor for commands like rm -rf, find -delete, shred, wipefs, truncate, or pkexec in unattended or automated workflows. Review terminal-security evaluator logs for bypassed restrictions.

Impact Analysis

This vulnerability can lead to unauthorized execution of destructive commands, causing irreversible data loss. Attackers could exploit indirect prompt injection in untrusted content like web pages or repository files to trigger commands that delete or corrupt files. The lack of proper path checks and command handling means even environment variables like $HOME can bypass security measures, enabling full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized data destruction or modification, violating GDPR's integrity and availability principles and HIPAA's safeguards for protected health information. Unattended execution of destructive commands may result in unauthorized access or loss of sensitive data, triggering non-compliance with data protection requirements.

Mitigation Strategies

Disable headless and auto modes in Continue CLI. Update to the latest version if available. Implement stricter command blocklists covering all dangerous paths and commands. Disable Bash tool permissions by default in unattended execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76072. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart