What happened
A command-injection flaw in Continue 2.0.0's MCPManagerSingleton.setConnections / ConfigHandler.ts builds an MCP server transport command from unvalidated config, allowing OS command injection when MCP connections are configured. CVSS 6.3, published 2026-10-26.
Why it matters
Continue is a widely used AI coding assistant that runs MCP servers locally with the developer's privileges. A command-injection in the MCP transport setup means a malicious repo/config/MCP server that the agent loads can execute code on the developer's machine or CI runner.
Attack vector
The MCP server transport configuration path is built from config values that are not safely shell-quoted, so a malicious or tampered MCP server config leads to OS command injection when the connection is set up (remote exploitation possible by inducing the assistant to load an attacker-supplied config or MCP server).
Affected systems
continuedev/Continue 2.0.0 (function MCPManagerSingleton.setConnections in core/config/ConfigHandler.ts, MCP Server Transport component).
Mitigation
Upgrade to a patched Continue release once available; avoid loading untrusted MCP server configs and validate/quote the transport command.