What happened
Published 2026-10-12 (CVSS 7.5 v3.1, CWE-863, SSVC exploitation=poc) by VulnCheck. The permission checker evaluates only the approved prefix of the composed command line. Verified via NVD REST API.
Why it matters
A third distinct AI coding agent in this window with the same structural flaw: command-permission gates that evaluate a prefix of the shell line can be bypassed by command chaining, converting prompt injection into arbitrary code execution on the developer host — a recurring, cross-vendor agent-execution pattern defenders should treat as a class.
Attack vector
Indirect prompt injection in repo files / fetched pages; the agent composes a command where a permission-approved Bash prefix is followed by an attacker-chosen payload separated by ;, &&, or |, which the permission check reports as approved but the shell executes in full.
Affected systems
Continue CLI (@continuedev/cli) through 1.5.47
Mitigation
No fixed release noted in the window; see VulnCheck advisory and Continue issue #13288. Treat untrusted repo/page content as able to drive command execution; review/disable 'Bash prefix' blanket-allow rules.