Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;, && or | to execute code as the user.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Continue CLI Bash allow-rules are prefix matches on the whole command string (CVE-2026-109560, CVSS 7.7). Approve ls once and ls; curl | sh still matches Bash(ls*). No fixed release yet; 1.5.47 is both the ceiling and latest on npm. If you save Bash(*) rules in permissions.yaml, have you audited them as prefix grants instead of exact commands?