Read the docs
TI-2026-71290 Aliases CVE-2026-109560GHSA-f54m-g39v-qf2p

Continue CLI permission bypass lets attackers run unapproved commands

Priority HIGH 69CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Continue CLI (@continuedev/cli) through 1.5.47 fails to enforce its Bash permission rules when commands are chained (CWE-863). An attacker who injects instructions into repository files or fetched pages can make the agent append commands after ;, && or | so they run as the user. Exploitation requires user interaction, and CISA SSVC rates exploitation as proof of concept.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;, && or | to execute code as the user.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00501 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
continuedevcontinueup to 1.5.47—No fix listedCNA
  • continue Vendorcontinuedev Affected up to 1.5.47 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for continue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-109560
  2. 2026-10-13 Alias added: GHSA-f54m-g39v-qf2p
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-13 Priority changed: MEDIUM → HIGH
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2026-53250 Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode CVSS 4.0HIGH 8.3
  • TI-2026-80242 OS command injection in continuedev Continue MCP server transport CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences