---
id: CVE-2026-109560
title: >-
  Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass
  vulnerability that allows attackers to run unapproved commands by chaining
  them after allowed Bash prefix rules
summary: >-
  Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass
  vulnerability that allows attackers to run unapproved commands by chaining
  them after allowed Bash prefix rules. Attackers can inject instructions into
  repositor…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-863
vendor: continuedev
product: continue
affected:
  - continue <= 1.5.47
published: '2026-10-12'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:18:44.867'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109560'
references:
  - url: 'https://github.com/continuedev/continue'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/continuedev/continue/blob/d3f60ba9dd3fb5bfd3c91d6fbb41ce1aa768db45/extensions/cli/src/permissions/permissionChecker.ts#L162-L174
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/continuedev/continue/blob/d3f60ba9dd3fb5bfd3c91d6fbb41ce1aa768db45/extensions/cli/src/permissions/policyWriter.ts#L18-L31
    label: disclosure@vulncheck.com
  - url: 'https://github.com/continuedev/continue/issues/13288'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/continue-cli-through-1.5.47-bash-permission-rule-bypass-via-command-chaining
    label: disclosure@vulncheck.com
  - url: 'https://github.com/continuedev/continue/issues/13288'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00501
epssPercentile: 0.42718
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-13T15:38:38.730434Z'
ingestedAt: '2026-10-12T22:05:40.358Z'
---

## Overview

Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;, && or | to execute code as the user.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.