CVE-2026-76072

Name of the Vulnerable Software and Affected Versions Continue CLI versions prior to 1.5.48

Description When running unattended in headless and auto modes, the software uses an incomplete denylist to block destructive shell commands. The isCriticalCommand function in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts serves as the primary control, but its dangerous-path test fails to block recursive forced removals of directories such as /home, /root, /var, /opt, or /srv. Additionally, the use of shell-quote for command line parsing reduces $HOME to an empty token, allowing commands like rm -rf $HOME to bypass security checks before the shell re-expands the variable. Other high-risk tools such as find with the -delete flag, shred, wipefs, truncate, and pkexec are either not disabled or not handled. This allows an indirect prompt injection—where the agent reads untrusted content from web pages, repository files, or issue text—to trigger the execution of destructive commands and destroy user data.

Recommendations Update Continue CLI to version 1.5.48 or later.