CVE-2026-76072: Continue CLI Privilege Escalation Vulnerability

CVE-2026-76072 Overview

CVE-2026-76072 is a security control failure in the Continue CLI, an AI coding agent distributed as @continuedev/cli. When the agent runs in headless mode or auto mode, the default policy grants the Bash tool the allow permission. The only remaining barrier to destructive shell commands is an incomplete denylist in the isCriticalCommand function inside packages/terminal-security/src/evaluateTerminalCommandSecurity.ts. An attacker can trigger destructive command execution through indirect prompt injection in web pages, repository files, or issue text that the agent autonomously reads.

Critical Impact
An unattended Continue CLI run can be induced to recursively delete user data in /home, /root, /var, /opt, or /srv through prompt injection in untrusted content.

Affected Products

Continue CLI (@continuedev/cli) in headless mode
Continue CLI (@continuedev/cli) in auto mode
Deployments relying on defaultPolicies.ts Bash allow permission

Discovery Timeline

2026-08-24 - CVE-2026-76072 published to the National Vulnerability Database
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-76072

Vulnerability Analysis

The Continue CLI relies on a single evaluator, isCriticalCommand, to block destructive shell commands when the Bash tool is pre-authorized. The evaluator implements an incomplete denylist [CWE-184]. Its dangerous-path check only matches /, /*, ~, ~/*, /usr, /etc, /bin, and /sbin. Recursive deletion of /home, /root, /var, /opt, or /srv is rated as high risk rather than disabled, so permissionChecker.ts still allows execution.

Command parsing uses shell-quote, which reduces $HOME to an empty token before the denylist check runs. The variable is then re-expanded by the shell at spawn time, letting rm -rf $HOME bypass the path test entirely. Related destructive operations such as find with -delete, shred, wipefs, truncate, and pkexec are not classified as disabled.

Root Cause

The root cause is a denylist-based security model that enumerates dangerous inputs rather than restricting to known-safe operations. The list omits common user data paths and does not account for shell variable expansion happening after tokenization. The mismatch between how shell-quote parses commands and how the spawned shell interprets them creates a parser differential that attackers can exploit.

Attack Vector

The Continue agent autonomously ingests content it does not control, including fetched web pages, repository files, and issue text. An indirect prompt injection embedded in that content can instruct the agent to execute a destructive shell command during an unattended run. Because the Bash tool is allow-listed by default policy and the denylist is incomplete, commands such as rm -rf /home, rm -rf $HOME, or find /var -delete execute against the invoking user's environment.

The vulnerability manifests in the interaction between defaultPolicies.ts, permissionChecker.ts, and evaluateTerminalCommandSecurity.ts. See the VulnCheck Advisory on Continue CLI and GitHub Issue #13001 for technical details.

Detection Methods for CVE-2026-76072

Indicators of Compromise

Unexpected rm -rf invocations targeting /home, /root, /var, /opt, or /srv originating from Continue CLI processes
Execution of find ... -delete, shred, wipefs, truncate, or pkexec spawned by the Continue agent
Continue CLI runs invoked with --headless or auto-mode flags that access untrusted external content

Detection Strategies

Monitor process ancestry for shell commands spawned by node processes running @continuedev/cli
Alert on destructive filesystem syscalls (unlinkat, renameat) initiated from AI agent processes
Inspect Continue CLI session logs for tool invocations that reference fetched web content or issue bodies followed by Bash tool calls

Monitoring Recommendations

Enable audit logging (auditd or equivalent) for execve events where the parent process is the Continue CLI
Forward agent tool-use telemetry to a central data lake for correlation between prompt content and executed commands
Track version pinning of @continuedev/cli across developer workstations and CI runners

How to Mitigate CVE-2026-76072

Immediate Actions Required

Stop running Continue CLI in headless or auto mode against untrusted repositories, web content, or issue trackers
Remove the Bash tool allow permission from defaultPolicies.ts and require explicit user approval for shell execution
Run the agent under a dedicated, unprivileged user account with no access to production data

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Track upstream fixes through the GitHub Continue Project Repository and the NPM Continue CLI Package. Review updates to packages/terminal-security/src/evaluateTerminalCommandSecurity.ts for expanded path coverage and handling of variable expansion.

Workarounds

Execute Continue CLI inside a container or sandbox with read-only mounts for user data and no host filesystem access
Replace the denylist policy with an allowlist that permits only the specific commands required for the workflow
Disable auto mode and headless mode when processing content sourced from external users or the public internet
Apply mandatory access controls such as AppArmor or SELinux profiles to restrict destructive syscalls for the agent process

bash

# Configuration example: run Continue CLI in a restricted sandbox
systemd-run --user --scope \
  -p ProtectHome=read-only \
  -p ProtectSystem=strict \
  -p NoNewPrivileges=yes \
  continue --config ./restricted-policy.yaml