CVE-2026-76072
Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode
Description
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts hard-blocks a command only when the terminal-security evaluator returns a disabled verdict, so isCriticalCommand in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts is the sole control. Its dangerous-path test matches only /, /*, ~, ~/*, /usr, /etc, /bin and /sbin and their prefixes, so a recursive forced removal of /home, /root, /var, /opt or /srv is not disabled. The command line is parsed with shell-quote, which reduces $HOME to an empty token, so rm -rf $HOME also fails the dangerous-path test while the shell re-expands the variable when the command is spawned. find with -delete is rated high risk rather than disabled, and shred, wipefs, truncate and pkexec are not handled. Because the agent autonomously reads content it does not control, including fetched web pages, repository files and issue text, an indirect prompt injection in that content can cause an unattended run to destroy the invoking user's data.
INFO
Published Date :
Aug. 24, 2026, 6:17 p.m.
Last Modified :
Oct. 12, 2026, 3:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-76072
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update the Continue CLI to the latest version.
- Review and enhance the command denylist.
- Implement stricter security checks for shell commands.
- Validate and sanitize all external content.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-76072.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-76072 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-76072
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-76072 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-76072 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 12, 2026
Action Type Old Value New Value Added Translation Title: continue de continuedev, Description: La CLI de Continue aplica una lista de denegación incompleta como su única barrera a comandos de shell destructivos cuando se ejecuta sin supervisión. En modo sin interfaz gráfica y modo automático, la política predeterminada en extensions/cli/src/permissions/defaultPolicies.ts otorga a la herramienta Bash el permiso de permitir, y permissionChecker.ts bloquea un comando de forma estricta solo cuando el evaluador de seguridad de terminal devuelve un veredicto de deshabilitado, por lo que isCriticalCommand en packages/terminal-security/src/evaluateTerminalCommandSecurity.ts es el único control. Su prueba de ruta peligrosa coincide solo con /, /*, ~, ~/*, /usr, /etc, /bin y /sbin y sus prefijos, por lo que una eliminación forzada recursiva de /home, /root, /var, /opt o /srv no está deshabilitada. La línea de comandos se analiza con shell-quote, lo que reduce $HOME a un token vacío, por lo que rm -rf $HOME también falla la prueba de ruta peligrosa mientras que el shell re-expande la variable cuando se genera el comando. find con -delete se clasifica como de alto riesgo en lugar de deshabilitado, y shred, wipefs, truncate y pkexec no se gestionan. Debido a que el agente lee de forma autónoma contenido que no controla, incluyendo páginas web obtenidas, archivos de repositorio y texto de incidencias, una inyección de prompt indirecta en ese contenido puede hacer que una ejecución sin supervisión destruya los datos del usuario invocador. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 24, 2026
Action Type Old Value New Value Added Reference https://github.com/continuedev/continue/issues/13001 Added SSVC {'id': 'CVE-2026-76072', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-24T18:35:13.915173Z'} -
New CVE Received by [email protected]
Aug. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/continuedev/continue', 'vendor': 'continuedev', 'product': 'continue', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '1.5.47'}], 'packageURL': 'pkg:npm/%40continuedev/cli', 'defaultStatus': 'unaffected'}] Added Description The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts hard-blocks a command only when the terminal-security evaluator returns a disabled verdict, so isCriticalCommand in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts is the sole control. Its dangerous-path test matches only /, /*, ~, ~/*, /usr, /etc, /bin and /sbin and their prefixes, so a recursive forced removal of /home, /root, /var, /opt or /srv is not disabled. The command line is parsed with shell-quote, which reduces $HOME to an empty token, so rm -rf $HOME also fails the dangerous-path test while the shell re-expands the variable when the command is spawned. find with -delete is rated high risk rather than disabled, and shred, wipefs, truncate and pkexec are not handled. Because the agent autonomously reads content it does not control, including fetched web pages, repository files and issue text, an indirect prompt injection in that content can cause an unattended run to destroy the invoking user's data. Added CVSS V4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Added CWE CWE-184 Added Reference https://github.com/continuedev/continue Added Reference https://github.com/continuedev/continue/blob/main/packages/terminal-security/src/evaluateTerminalCommandSecurity.ts Added Reference https://github.com/continuedev/continue/issues/13001 Added Reference https://www.npmjs.com/package/@continuedev/cli Added Reference https://www.vulncheck.com/advisories/continue-cli-through-incomplete-destructive-command-denylist-in-headless-and-auto-mode