Continue CVE-2026-116109

Exploitation requires a Continue 2.0.0 user to add or connect to an attacker-controlled MCP server configuration; the malicious input is processed by MCPManagerSingleton.setConnections when establishing the MCP Server Transport, leading to OS command injection. The CVSS UI:P metric confirms user interaction is required - the victim must load or trust the malicious MCP server, so this is not a default remote-reachable service exposed to unauthenticated attackers. The precise tainted parameter and exactly how it reaches the shell are not described in the available sources (VulDB only). Limiting factors: required user interaction, dependence on the victim configuring a hostile MCP server rather than a default deployment, and scope currently confirmed only for version 2.0.0.

Signals are mixed and point to a moderate, user-interaction-gated issue rather than an urgent widespread threat. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, score 5.3) describes a network-reachable, low-complexity flaw needing no prior privileges but requiring passive user interaction (UI:P), with the vendor rating each impact dimension Low (VC:L/VI:L/VA:L). That Low impact rating is notably conservative for a CWE-78 OS command injection, which by nature yields arbitrary command execution - I assess the technical impact as higher than the input suggests (see assessed vectors). Exploit maturity is E:P (proof-of-concept); the description states the exploit was disclosed publicly, so a public PoC reference exists but it is not verified as working exploit code. There is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or automated exploitation. The vuln.today decision label is this_month (not act_now/emergency), consistent with a real but non-emergency priority. A key limiting factor is the UI:P requirement: a user must connect to or load an attacker-controlled MCP server configuration, which is not a default remote-reachable service. All intelligence derives from a single source (VulDB); the vendor was contacted but did not respond, so affected-version scope beyond 2.0.0 and any fix are unconfirmed.

An attacker publishes or shares a malicious Model Context Protocol (MCP) server configuration and lures a Continue 2.0.0 user into adding or connecting to it. When Continue establishes the MCP Server Transport through MCPManagerSingleton.setConnections, attacker-controlled input is passed to an OS command, executing arbitrary commands with the developer's privileges. A public proof-of-concept reference exists but is not verified as working exploit code, and the low attack complexity (AC:L) means little attacker skill is needed once the user interacts.