plaincve:~$

// threat brief

CVE-2026-109560

Continue CLI Bash permission rule bypass: chaining commands after an allowed prefix runs commands nobody approved

CVSS
7.7 HIGH
CISA KEV
Not listed
Weakness
CWE-863
Topics
AI security · Supply chain

PlainCVE Team · Published 2026-10-19 · AI-assisted · Press brief ↓

AI review 2026-10-19 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

Continue CLI through 1.5.47 matches Bash allow rules against the whole command, so an injected agent can chain unapproved commands after an allowed one.

Who is affectedDevelopers using the npm package @continuedev/cli up to and including 1.5.47 who have a Bash prefix allow rule in their permission settings (for example, one saved when choosing "Continue + don't ask again" on the approval prompt, or one they set themselves; a one-time "Continue" does not save a rule).
What happensIf the agent reads a repository file or web page with planted instructions, commands you never approved may run without a confirmation prompt, with the privileges of the user running the agent.
What to do nowThere is no fixed version; the latest version on npm, 1.5.47, is itself affected. PlainCVE suggests removing broad Bash prefix allow rules and not running the agent in untrusted environments or with elevated privileges.
Affected versionsAll versions up to and including 1.5.47
Fixed versionsNo fixed version: the latest version on npm, 1.5.47, is itself in the affected range (the 2.0.0 mentioned in the README cannot be found on npm)
CVSS vector
Show full vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Timeline
  • First public 2026-09-17

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check whether you have an affected version

    Run this in a terminal on the computer where Continue CLI is installed; if it is installed inside a project, run it in the project folder and drop -g. All @continuedev/cli versions up to and including 1.5.47 are in the CVE's affected range, and 1.5.47 is the latest version on npm.

    Read-only check
    npm ls -g @continuedev/cli
  2. 02Check for Bash prefix allow rules

    The bypass needs an allow rule like Bash(name*) to exist. Review every Bash(name*) allow rule in your permission settings, whether it was saved when you chose "Continue + don't ask again" on the approval prompt or you set it yourself.

    Step 2Step 4
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Remove broad Bash prefix allow rules

    Our analysis: making every shell command ask for approval would likely reduce exposure. No source states this, and no source shows an official fix.

    Step 2Step 4
  2. 02Don't run the agent in untrusted environments or with elevated privileges

    Advice from a third-party site (OffSeq), not vendor guidance.

    Step 1Step 5
RESPONDRespondIf you find signs of compromise
  1. 01If you suspect abuse, review what commands the agent ran

    PlainCVE's suggestion: look for commands that start with an approved prefix but have other commands chained after it, and check which repositories or pages the agent read at the time. The sources give no official detection guidance.

    Step 3Step 5
HARDENHardenPrevent the next one
  1. 01Treat external content the agent reads as untrusted

    Repository files and fetched pages can both carry instructions aimed at the AI.

    Step 1Step 3
  2. 02Keep the project's maintenance status in mind

    The vendor says the continuedev/continue repository is no longer actively maintained and is read-only, so a fix may never come.

Full remediation steps and notes

There is no fixed version yet. The latest @continuedev/cli version on the npm registry is 1.5.47, which is itself affected, and no source names a merged fix. The researcher’s GitHub issue #13288 (that page contains attack code, so we do not link to it) is still open with no linked branch or pull request. The third-party trackers HOL Guard and OffSeq also say a fix has not been reported or confirmed. The vendor also says the continuedev/continue repository is no longer actively maintained and is read-only, so don’t count on a future fix.

  1. Check your version. In a terminal on the computer where Continue CLI is installed, run npm ls -g @continuedev/cli (if it is installed inside a project, run it in the project folder and drop -g).
  2. About PR #12248. An outside contributor submitted a PR that made the permission checker use the stricter of the static and dynamic policies, but the author closed it unmerged after declining to sign the CLA. Our analysis: the PR does not describe splitting chained commands before matching, so even if it had been merged it might not fully fix this CVE.
  3. There is no fixed version to upgrade to. The vendor’s README mentions a final CLI 2.0.0 release, but that version cannot be found on the npm registry. The latest version on npm, 1.5.47, is still in the affected range. Use the measures below instead.
  4. PlainCVE’s suggestion. Removing broad Bash(prefix*) allow rules, so shell commands always ask for approval, would likely reduce exposure (no source states this directly). The third-party site OffSeq also advises not running the agent in untrusted environments or with elevated privileges until a fix exists; this is not vendor guidance.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

Continue CLI Bash permission rule bypass: chaining commands after an allowed prefix runs commands nobody approved: 1. Plants instructions for the AI in a repository file or web page → 2. A Bash prefix allow rule exists in the permission settings → 3. The agent reads the planted instructions and chains extra commands after the allowed one → 4. The permission check treats the whole chain as matching the rule → 5. Unapproved commands run silently as the userCVE-2026-109560 · Continue CLI Bash permission rule bypass: chaining commands after an allowed prefix runscommands nobody approvedAttackerYour systemPlants instructions for the AI in a repository file or web page — This is called prompt injection: hiding instructions in content the agent will read. The attacker needs no privileges. 1Plantsinstructions forthe AI in arepository file o…A Bash prefix allow rule exists in the permission settings — The rule may be one the user set themselves or one saved when the user chose "Continue + don't ask again" on the approval prompt. After that choice, the CLI saves an allow rule using only the first command name plus a wildcard, like Bash(name*). A one-time "Continue" does not save a rule. 2A Bash prefixallow rule existsin the permissionsettingsThe agent reads the planted instructions and chains extra commands after the allowed one — The extra commands are joined after the allowed prefix with ;, && or |. 3The agent readsthe plantedinstructions andchains extr…The permission check treats the whole chain as matching the rule — The researcher says the rule becomes a regex matched against the entire command string, not just the first command. Separately, in the vendor's code a static allow rule overrides the dynamic security evaluator unless the evaluator returns 'disabled'. 4The permissioncheck treats thewhole chain asmatching the ruleUnapproved commands run silently as the user — The researcher says no confirmation prompt appears. 5Unapprovedcommands runsilently as theuserAttack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-109560-continue-cli-bash-permission-bypass · CC BY 4.0
Continue CLI Bash permission rule bypass: chaining commands after an allowed prefix runs commands nobody approved: 1. Plants instructions for the AI in a repository file or web page → 2. A Bash prefix allow rule exists in the permission settings → 3. The agent reads the planted instructions and chains extra commands after the allowed one → 4. The permission check treats the whole chain as matching the rule → 5. Unapproved commands run silently as the userCVE-2026-109560 · Continue CLI Bashpermission rule bypass: chainingcommands after an allowed prefix runscommands nobody approvedPlants instructions for the AI in a repository file or web page — This is called prompt injection: hiding instructions in content the agent will read. The attacker needs no privileges. 1AttackerPlants instructions for the AIin a repository file or web pageA Bash prefix allow rule exists in the permission settings — The rule may be one the user set themselves or one saved when the user chose "Continue + don't ask again" on the approval prompt. After that choice, the CLI saves an allow rule using only the first command name plus a wildcard, like Bash(name*). A one-time "Continue" does not save a rule. 2Your systemA Bash prefix allow rule existsin the permission settingsThe agent reads the planted instructions and chains extra commands after the allowed one — The extra commands are joined after the allowed prefix with ;, && or |. 3Your systemThe agent reads the plantedinstructions and chains extracommands after the allowed oneThe permission check treats the whole chain as matching the rule — The researcher says the rule becomes a regex matched against the entire command string, not just the first command. Separately, in the vendor's code a static allow rule overrides the dynamic security evaluator unless the evaluator returns 'disabled'. 4Your systemThe permission check treats thewhole chain as matching the ruleUnapproved commands run silently as the user — The researcher says no confirmation prompt appears. 5AttackerUnapproved commands runsilently as the userAttack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-109560-continue-cli-bash-permission-bypass
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    Plants instructions for the AI in a repository file or web page

    This is called prompt injection: hiding instructions in content the agent will read. The attacker needs no privileges.

    Defense: Third-party advice: until a fix exists, don't run the agent in untrusted environments.

  2. Your system

    A Bash prefix allow rule exists in the permission settings

    The rule may be one the user set themselves or one saved when the user chose "Continue + don't ask again" on the approval prompt. After that choice, the CLI saves an allow rule using only the first command name plus a wildcard, like Bash(name*). A one-time "Continue" does not save a rule.

    Defense: Our analysis: remove broad Bash prefix allow rules so every shell command asks for approval.

  3. Your system

    The agent reads the planted instructions and chains extra commands after the allowed one

    The extra commands are joined after the allowed prefix with ;, && or |.

  4. Your system

    The permission check treats the whole chain as matching the rule

    The researcher says the rule becomes a regex matched against the entire command string, not just the first command. Separately, in the vendor's code a static allow rule overrides the dynamic security evaluator unless the evaluator returns 'disabled'.

    Defense: Researcher's proposal: split compound commands before matching and check each part. This is a proposal, not a shipped fix.

  5. Attacker

    Unapproved commands run silently as the user

    The researcher says no confirmation prompt appears.

    Defense: Third-party advice: don't run the agent with elevated privileges, to limit the damage.

Who is affected

Continue CLI (the npm package @continuedev/cli) is an AI coding assistant (an “agent”) that can run shell commands in your terminal for you. Before running one, it checks permission rules to decide whether to ask you first.

ConditionAffected?
@continuedev/cli up to and including 1.5.47, with a Bash prefix allow rule in place (for example, saved when choosing “Continue + don’t ask again”, or set by the user)Affected
Up to and including 1.5.47, but no Bash prefix allow rulesThe bypass needs an allowed prefix rule to work
2.0.0The vendor’s README mentions a final 2.0.0 release, but that version cannot be found on the npm registry, so it is not an upgrade option

There is no fixed version. The latest @continuedev/cli version on the npm registry is 1.5.47. Its gitHead is the same commit (d3f60ba) that the CVE record points to as the vulnerable code, so it is itself in the affected range.

The attack has one more condition: the attacker must get instructions into content the agent reads, such as a file in a repository or a web page the agent fetches (this is called “prompt injection”). According to CVSS, the attacker needs no privileges.

How it works

The CVE record only requires that “allowed Bash prefix rules” exist; it does not say where they come from, and the vendor’s permission checker matches all rules the same way. A Bash(name*) rule you set yourself counts too. When a Bash command needs approval, the prompt offers three choices: “Continue”, “Continue + don’t ask again”, and “No, and tell Continue what to do differently”. Only “Continue + don’t ask again” saves a rule; a one-time “Continue” does not. When you choose “Continue + don’t ask again”, the vendor’s code keeps only the first command name, adds a wildcard, and saves a rule like Bash(name*). The reporting researcher says this rule becomes a regular expression that is checked against the entire command string, not just the first command. So as long as it starts with an allowed name, anything chained after it with ;, && or | also matches.

On top of that, in the vendor’s permission checker, a static allow rule overrides the result of the dynamic security evaluator (unless the evaluator returns “disabled”). The researcher says these chained commands run silently, without a confirmation prompt, and they run with the privileges of the user running the agent. This kind of mistake is CWE-863 (incorrect authorization).

The flawed approach (conceptual illustration, not the original source code):

Show code example(text)
rule = "allow: any string starting with <name>"
if whole_command matches rule:
    run it   # commands chained after it are allowed too

The approach the researcher proposed (a proposal, not a shipped fix):

Show code example(text)
parts = split command on ; && ||
if every part matches an allow rule on its own:
    run it
else:
    ask the user

Timeline

DateEvent
2026-04-28An outside contributor’s PR #12248 publicly describes static allow rules in permissionChecker.ts overriding the dynamic policy evaluation (it does not mention command chaining); the PR was never merged
2026-09-17The researcher opens issue #13288 publicly on GitHub (that page contains attack code, so we do not link to it); also the public date in the CVE record
2026-10-12VulnCheck publishes the CVE record
2026-10-13Not in CISA KEV as of this date; NVD has received the record but not analyzed it
2026-10-16NVD record last modified; its current status is Deferred (analysis deferred). NVD’s data does not show the date the status changed

Further reading

  • Scoring: The CNA (VulnCheck) gives CVSS 4.0 7.7 and CVSS 3.1 7.5, both rated High. The numbers differ only because the CVSS versions differ; the sources do not actually disagree. CVSS 3.1 rates attack complexity as high and requires user interaction; CVSS 4.0 lists user interaction as passive and attack requirements as present.
  • Exploitation: Not in CISA KEV. There is no evidence of exploitation in the wild, and no evidence either way on exploitation before a patch. HOL Guard says its sources do not mark it as known exploited, which does not prove it was never exploited. The researcher’s GitHub issue #13288 includes a reproduction (that page contains attack code, so we do not link to it).
  • Who issued the CVE: VulnCheck assigned it, not the Continue project. The GitHub Advisory Database lists it as GHSA-f54m-g39v-qf2p, not yet reviewed. The CVE record credits Akıner Kısa and Tardfyou.
  • Don’t confuse it with: CVE-2026-76072, a separate VulnCheck CVE for the same version range, about an incomplete list of blocked destructive commands in headless and auto mode (VulnCheck’s advisory for that CVE contains attack code, so we do not link to it).
  • Related weakness type: CWE-863.

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-19 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. CVE / NVD / OSVCVE-2026-109560 CVE record (JSON) · CVE Program (CNA: VulnCheck), 2026-10-12 · accessed 2026-10-13
  2. CVE / NVD / OSVNVD API - CVE-2026-109560 · NIST · accessed 2026-10-18
  3. AdvisoryGitHub Advisory Database - GHSA-f54m-g39v-qf2p (unreviewed) · GitHub · accessed 2026-10-13
  4. Othernpm registry - @continuedev/cli latest · npm · accessed 2026-10-17
  5. Vendorcontinuedev/continue repository README · Continue · accessed 2026-10-13
  6. VendorpermissionChecker.ts at d3f60ba · Continue (GitHub) · accessed 2026-10-13
  7. VendorpolicyWriter.ts at d3f60ba · Continue (GitHub) · accessed 2026-10-13
  8. VendorToolPermissionSelector.tsx at d3f60ba · Continue (GitHub) · accessed 2026-10-18
  9. OtherPull request #12248 (closed, not merged) · continuedev/continue (GitHub) · accessed 2026-10-13
  10. OtherCVE-2026-109560 - HOL Guard · HOL Guard · accessed 2026-10-13
  11. OtherCVE-2026-109560: Incorrect Authorization in continuedev continue · OffSeq Radar · accessed 2026-10-13

Press brief

In one sentence

Continue CLI is an AI coding assistant that can run shell commands for developers. In versions up to and including 1.5.47, a command approved with "Continue + don't ask again" becomes a broad allow rule (Bash prefix allow rules users set themselves behave the same way), so if an attacker hides instructions in a repository file or web page, the agent may chain other commands after the approved one and run them. There is no fixed version (the latest version on npm, 1.5.47, is itself affected), and the vendor says the repository is no longer actively maintained.

Key facts

Severity
CVSS 4.0 7.7; CVSS 3.1 7.5 (both from the CNA, VulnCheck) cveawg.mitre.org
Affected versions
@continuedev/cli up to and including 1.5.47 cveawg.mitre.org
Issue made public
2026-09-17 (public date in the CVE record; the researcher's GitHub issue #13288 was opened the same day; that page contains attack code, so we do not link to it) cveawg.mitre.org
CVE published
2026-10-12 cveawg.mitre.org
Maintenance status
Vendor says the repository is no longer actively maintained and is read-only github.com

Confirmed

  • Continue CLI up to and including 1.5.47 lets commands chained after an allowed Bash prefix run without the user's approval.
  • In the vendor's code, choosing "Continue + don't ask again" saves only the first command name plus a wildcard (a one-time "Continue" saves no rule), and a static allow rule overrides the dynamic security evaluator unless the evaluator returns 'disabled'.
  • The researcher's GitHub issue #13288 (that page contains attack code, so we do not link to it) includes a reproduction, and it is still open with no linked fix.
  • There is no fixed version: the latest @continuedev/cli version on the npm registry is 1.5.47, which is in the affected range.
  • NVD's current status is Deferred (analysis deferred; record last modified 2026-10-16).

Unconfirmed / disputed

  • The vendor's README mentions a final CLI 2.0.0 release, but that version cannot be found on the npm registry, so it is unknown whether it exists or contains a fix.
  • There is no evidence of exploitation in the wild, nor of exploitation before a patch; it is not in CISA KEV.

Quotable line

You told it not to ask again about one command, but the tool remembered it as "anything that starts with this word."

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "Continue CLI Bash permission rule bypass: chaining commands after an allowed prefix runs commands nobody approved". PlainCVE. https://plaincve.date/en/vulns/cve-2026-109560-continue-cli-bash-permission-bypass (accessed YYYY-MM-DD)
BibTeX
@misc{cve2026109560continueclibashpermissionbypass2026,
  title  = {Continue CLI Bash permission rule bypass: chaining commands after an allowed prefix runs commands nobody approved},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-109560-continue-cli-bash-permission-bypass},
  note   = {Updated 2026-10-19}
}