Continue CLI version 1.5.47 contains a rule that is intended to allow only whitelisted Bash commands to be appended to the agent’s execution list. The vulnerability lets an attacker inject additional commands by placing malicious instructions in repository files or data fetched from external sources, and then chaining them after the allowed prefix using characters such as semicolons, logical AND, or pipes. This bypass enables the attacker to run arbitrary shell commands with the privileges of the user who invokes the CLI, potentially leading to information disclosure, modification of code, or further compromise of the system. The weakness is identified as CWE‑863, which describes a missing authorization check.

Products affected are Continue CLI (continuedev:continue). All releases through version 1.5.47 are vulnerable; versions 1.5.48 and later contain the fix.

The CVSS score of 7.7 indicates a high severity of the bypass. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw if they can place or modify files that the CLI processes, or if they can feed data to the CLI from an untrusted web source; this is inferred from the description and the nature of command chaining. Successful exploitation results in the execution of arbitrary code with the user’s privileges, which can compromise the entire host or exposed services.