Description

The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts hard-blocks a command only when the terminal-security evaluator returns a disabled verdict, so isCriticalCommand in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts is the sole control. Its dangerous-path test matches only /, /*, ~, ~/*, /usr, /etc, /bin and /sbin and their prefixes, so a recursive forced removal of /home, /root, /var, /opt or /srv is not disabled. The command line is parsed with shell-quote, which reduces $HOME to an empty token, so rm -rf $HOME also fails the dangerous-path test while the shell re-expands the variable when the command is spawned. find with -delete is rated high risk rather than disabled, and shred, wipefs, truncate and pkexec are not handled. Because the agent autonomously reads content it does not control, including fetched web pages, repository files and issue text, an indirect prompt injection in that content can cause an unattended run to destroy the invoking user's data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-24T18:17:21.233Z",
  "pubdate": "2026-08-24T18:17:21.233Z",
  "executiveSummary": "A critical security vulnerability exists within the Continue CLI that allows destructive shell commands to be executed during unattended runs via an incomplete denylist mechanism.\nThe vulnerability affects the Continue CLI operating in headless mode and auto mode, where the default policy grants the Bash tool the allow permission.\nThe primary impact of this flaw is arbitrary data destruction on the host system, potentially leading to complete loss of user data.\nThe root cause stems from an inadequate security evaluator implemented in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts, which relies on a restrictive and easily bypassed denylist rather than an allowlist or robust sandboxing.\nAn attacker can exploit this vulnerability by leveraging indirect prompt injection through untrusted content that the autonomous agent reads, such as fetched web pages, repository files, and issue text.\nExploitation requires the agent to run in an unattended context (headless or auto mode) and process maliciously crafted input designed to trigger destructive shell commands that bypass the terminal security checks.",
  "technicalDetails": "The vulnerability originates in the permission checking logic of the Continue CLI, specifically within extensions/cli/src/permissions/defaultPolicies.ts and packages/terminal-security/src/evaluateTerminalCommandSecurity.ts.\nWhen the CLI operates in headless mode and auto mode, the default policy assigns the allow permission to the Bash tool, deferring security enforcement entirely to the terminal-security evaluator.\nThe core security control, isCriticalCommand, implemented in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts, relies on an incomplete denylist that only matches a rigid set of paths: /, /*, ~, ~/*, /usr, /etc, /bin, and /sbin, along with their direct prefixes.\nConsequently, critical system and user directories such as /home, /root, /var, /opt, and /srv are omitted from the denylist, allowing recursive forced removal operations targeting these paths to execute successfully without triggering a disabled verdict.\nFurthermore, the command line parser utilizes shell-quote, which reduces environment variables like $HOME to an empty token. As a result, commands such as rm -rf $HOME fail the static dangerous-path test during evaluation, but successfully re-expand when the shell spawns the actual command execution.\nAdditional gaps in the terminal-security evaluator include rating destructive utilities like find with -delete merely as high risk rather than blocking them outright, while failing to handle dangerous commands such as shred, wipefs, truncate, and pkexec.\nThe exploitation vector relies on indirect prompt injection. Because the autonomous agent reads untrusted external content—including fetched web pages, repository files, and issue text—an attacker can embed malicious instructions within this data.\nDuring an unattended run, the agent ingests the poisoned content, interprets the injected instructions, and autonomously constructs a destructive shell command designed to evade the incomplete denylist.\nUpon execution, the command bypasses the permission checker, resulting in unauthorized data destruction within unprotected directories on the host operating system."
}