The Continue CLI implements an incomplete denylist as its sole protection against destructive shell commands when it runs unattended in headless or auto mode. The vulnerable logic allows commands that recursively remove critical system directories such as /home, /root, /var, /opt and /srv to pass the dangerous‑path filter. Additionally, commands like rm -rf $HOME, find with -delete, shred, wipefs, truncate and pkexec bypass the current checks, as the use of shell-quote expands shell variables only at execution time. This flaw enables an attacker to finalise destructive operations that permanently erase user data or system files, resulting in irreversible loss of volume contents and potential service discontinuity.

Vendors and products affected include Continue by Continue Development, specifically the Continue CLI tool. The vulnerability stems from files in the extensions/cli/src/permissions/defaultPolicies.ts and packages/terminal-security/src/evaluateTerminalCommandSecurity.ts within the CLI package.

The CVSS score of 8.3 indicates very high severity. EPSS is not available so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires the CLI to run in headless or auto mode with unattended execution. An attacker can provide malicious prompt content that the agent autonomously reads—such as a compromised repository file or a malicious web page—to trigger destructive shell commands. Once executed, the damage is immediate and recoverable only with backups.