A flaw in continuedev Continue 2.0.0 allows an attacker to manipulate the MCPManagerSingleton.setConnections function in core/config/ConfigHandler.ts. This manipulation leads to OS command injection, which can be used to execute arbitrary shell commands on the host. The vulnerability can be triggered remotely and is publicly disclosed, meaning an attacker could compromise the server if the exploit is used against an unpatched installation.

The affected product is continuedev Continue, version 2.0.0. No other versions or variants are listed in the CVE data, so only this specific release is known to be vulnerable.

The vulnerability has a CVSS score of 5.3 indicating moderate baseline risk, but the potential for remote code execution through OS command injection elevates its practical threat. Because the attack vector is remote and the exploit has been publicly disclosed, the likelihood of exploitation is non‑negligible despite the lack of an EPSS value. The product is not listed in CISA's KEV catalog, but the absence of a KEV designation does not mitigate the risk of an attacker using the disclosed exploit. The attacker would need to reach the MCP Server Transport component – likely via a configuration API – and supply malicious input to trigger the injection. No specific prerequisites are documented beyond remote access.