Continue
Monthly
Incomplete destructive-command denylist in Continue CLI's headless and auto modes enables indirect prompt injection to trigger irreversible data destruction on the invoking user's filesystem. The sole safety gate, isCriticalCommand in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts, blocks only eight path prefixes and misses /home, /root, /var, /opt, and /srv entirely; a secondary bypass exists because shell-quote reduces $HOME to an empty token during the path check while the shell correctly re-expands the variable at execution. Because the agent autonomously consumes untrusted content - fetched web pages, repository files, and issue text - a malicious payload planted in any such source can cause an unattended run to destroy user data; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Path traversal in Continue 1.2.22 and earlier allows local authenticated attackers to read arbitrary files on the host system via crafted dirPath parameters to the lsTool function in the JSON-RPC server. The vulnerability has a publicly available exploit (GitHub Gist) but CVSS base score of 3.3 (Low) reflects limited impact due to local access requirement, low privilege requirement, and confidentiality-only impact with no integrity or availability consequences. EPSS data unavailable; not listed in CISA KEV, indicating no confirmed widespread exploitation.
Incomplete destructive-command denylist in Continue CLI's headless and auto modes enables indirect prompt injection to trigger irreversible data destruction on the invoking user's filesystem. The sole safety gate, isCriticalCommand in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts, blocks only eight path prefixes and misses /home, /root, /var, /opt, and /srv entirely; a secondary bypass exists because shell-quote reduces $HOME to an empty token during the path check while the shell correctly re-expands the variable at execution. Because the agent autonomously consumes untrusted content - fetched web pages, repository files, and issue text - a malicious payload planted in any such source can cause an unattended run to destroy user data; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Path traversal in Continue 1.2.22 and earlier allows local authenticated attackers to read arbitrary files on the host system via crafted dirPath parameters to the lsTool function in the JSON-RPC server. The vulnerability has a publicly available exploit (GitHub Gist) but CVSS base score of 3.3 (Low) reflects limited impact due to local access requirement, low privilege requirement, and confidentiality-only impact with no integrity or availability consequences. EPSS data unavailable; not listed in CISA KEV, indicating no confirmed widespread exploitation.