Permission Bypass in Continue CLI via Command Injection

Executive Summary

This vulnerability is a permission bypass in Continue CLI versions up to 1.5.47. It allows attackers to execute unauthorized commands by appending them to allowed Bash commands using operators like ;, &&, or |. Attackers can inject these commands into repository files or fetched pages, tricking the agent into running malicious code as the user.

Useful 0 Not Useful 0

Detection Guidance

Check for unusual command execution patterns in logs, especially those involving chained commands with ;, &&, or | after allowed Bash prefixes. Inspect repository files and fetched pages for injected instructions that append unauthorized commands.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to run arbitrary commands on your system with your user privileges. This could lead to data theft, system compromise, or unauthorized actions performed in your name. It primarily affects users of Continue CLI who interact with untrusted repositories or web content.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers to bypass permission controls and execute unauthorized commands, which could lead to unauthorized data access, modification, or exfiltration. Such actions directly violate compliance requirements under GDPR (data protection and privacy) and HIPAA (protected health information security), as they enable unauthorized processing or disclosure of sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Update Continue CLI to the latest version beyond 1.5.47. Review and restrict Bash prefix rules to prevent command chaining. Monitor for unauthorized command executions and audit repository files and fetched pages for suspicious modifications.

Useful 0 Not Useful 0