# Continue CLI: chained commands bypass the Bash approval rule

> Continue CLI checked whether a Bash command was approved by matching the start of the line, so extra commands chained onto an approved one ran unasked.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-12
- **CVE:** CVE-2026-109560
- **CVSS:** 7.7
- **Affects:** Continue CLI
- **Research by:** Akıner Kısa, Chengzhi Yi
- **Primary source:** https://www.vulncheck.com/advisories/continue-cli-through-1.5.47-bash-permission-rule-bypass-via-command-chaining
- **Page:** https://theinjection.dev/items/continue-cli-bash-approval-bypass/

CVE-2026-109560 lets text planted in a repository or a fetched web page add commands after an approved Bash prefix rule in Continue CLI, so they run as the user. Versions through 1.5.47 are affected, with no fix listed.

## What happened

VulnCheck published CVE-2026-109560 on October 12, 2026, a permission bypass in the Continue CLI coding agent, and credits Akıner Kısa and Tardfyou. The underlying report, issue 13288 in the continuedev/continue repository, was opened on September 17, 2026 by Chengzhi Yi and is still open with no maintainer reply.

## How it works

A static allow rule such as Bash(ls*) is turned into a regular expression and tested against the whole command string, without parsing shell syntax (CWE-863). A chained line like ls; cat /etc/passwd therefore still matches the rule. Instructions planted in repository files or in pages the agent fetches can steer it into appending commands after a semicolon, a double ampersand or a pipe, and those commands run with the user's privileges.

## Who is affected

Continue CLI, published as the @continuedev/cli package, is affected through version 1.5.47. Setups that have approved broad Bash prefix rules carry the most risk, and VulnCheck lists no fixed version.

## What to do

Replace broad Bash prefix allow rules in Continue CLI with narrow ones, or approve commands one at a time, until a fixed release ships. Keep the agent away from untrusted repositories and web pages while permissive rules are in place.

## Quick facts

- **CVE:** CVE-2026-109560
- **CVSS 4.0:** 7.7
- **Affected:** Continue CLI (@continuedev/cli) through 1.5.47
- **Fixed in:** No fixed version listed
- **Weakness:** CWE-863, allow rule matched against the whole command
- **Found by:** Akıner Kısa and Chengzhi Yi (Tardfyou), via VulnCheck
- **Status:** Report open since September 17, 2026, no maintainer reply

## Questions

### Which Continue CLI versions are affected by CVE-2026-109560?

CVE-2026-109560 affects Continue CLI, the @continuedev/cli package, through version 1.5.47. VulnCheck lists no fixed version, and the GitHub report describing the behavior, issue 13288, is still open with no maintainer reply. Teams running the CLI should tighten their Bash allow rules now rather than wait for a version number to upgrade to.

### How do I check whether my Continue CLI setup is exposed?

Look at the Bash permission rules in your Continue CLI configuration. Broad prefix rules such as Bash(ls*) are the condition the bypass needs, because Continue CLI tests the rule against the whole command line instead of parsing shell syntax. A rule that allows one safe command therefore also allows whatever is chained after it.

### Does an attacker need access to my machine to use this bypass?

No. VulnCheck describes the attacker input as instructions placed in repository files or in web pages the agent fetches, so the content arrives through normal agent work. The approved prefix rule does the rest, which is why CVE-2026-109560 carries a network attack vector in its CVSS 4.0 score of 7.7.

### How does CVE-2026-109560 compare with earlier agent approval bypasses?

Continue CLI repeats a pattern this feed has recorded in other coding agents: the approval check tests the start of a command and ignores shell syntax, so chaining defeats it. The lesson for defenders is that an approval prompt is not a security boundary unless the tool parses the command it is approving.

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/continue-cli-through-1.5.47-bash-permission-rule-bypass-via-command-chaining)
2. [GitHub Advisory](https://github.com/advisories/GHSA-f54m-g39v-qf2p)
3. [Original Report](https://github.com/continuedev/continue/issues/13288)