Vulnerabilities

TI-2026-80242 CVE-2026-116109 · GHSA-3cxv-6mgc-j7c4

OS command injection in continuedev Continue MCP server transport

LOW 26

A vulnerability has been found in continuedev Continue 2.0.0.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.01154 Published 2026-10-26 No fix listed CWE-77

TI-2026-71290 CVE-2026-109560 · GHSA-f54m-g39v-qf2p

Continue CLI permission bypass lets attackers run unapproved commands

HIGH 69

Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00501 Published 2026-10-12 No fix listed CWE-863

TI-2026-53250 CVE-2026-76072 · GHSA-xqr4-4xjv-5j7q

Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode

HIGH 71

The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00392 Published 2026-08-24 No fix listed CWE-184

Vulnerabilities

Filters

OS command injection in continuedev Continue MCP server transport

Continue CLI permission bypass lets attackers run unapproved commands

Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode