Continue CLI Ships With a Destructive-Command Denylist That Misses rm -rf $HOME (CVE-2026-76072)

NVD·high signalXBlueskyLinkedInCopy link

VulnCheck disclosed on 2026-08-24 that Continue CLI's headless and auto modes grant the Bash tool blanket allow permission, leaving isCriticalCommand in packages/terminal-security as the only guard. Its dangerous-path test matches only /, ~, /usr, /etc, /bin and /sbin, so recursive deletion of /home, /root, /var, /opt or /srv passes, and because the line is parsed with shell-quote, $HOME collapses to an empty token before the shell re-expands it at spawn time. find -delete is rated high risk rather than blocked, and shred, wipefs, truncate and pkexec are unhandled, so an indirect prompt injection in a fetched page or issue body can wipe the invoking user's data. CVSS 4.0 base 8.3.