Continue CLI's filter fails to stop a full $HOME wipe

Continue CLI's headless and auto modes give its Bash tool blanket permission to run shell commands. A single filter, isCriticalCommand, is the only defense against destructive commands, per NVD's listing for CVE-2026-76072.

The flaw carries a CVSS score of 8.3. An attacker doesn't need a terminal or credentials. A poisoned web page or a booby-trapped GitHub issue, fetched by the agent mid-task, is enough to fire the delete command against the user's files.

The filter's dangerous-path check matches /, ~, /usr, /etc, /bin and /sbin. It doesn't match /home, /root, /var, /opt or /srv, so a recursive delete aimed at any of those five paths sails through unblocked.

$HOME fares no better. The line gets parsed with shell-quote before the shell ever sees it, and $HOME collapses to an empty token at that stage. The check runs against the empty string. Then the real shell expands $HOME back to the user's home directory when the command spawns, and deletes it.

The filter also misjudges find -delete, rating it high risk instead of blocking it outright. Four other destructive tools, shred, wipefs, truncate and pkexec, aren't handled at all.

NVD's advisory doesn't say whether Continue has fixed the flaw yet.