The Continue CLI applies an incomplete denylist as its sole barrier against destructive shell commands during unattended runs. In headless and auto modes, the Bash tool is allowed by default, and commands are only blocked if the terminal-security evaluator returns a disabled verdict. The dangerous-path test only matches certain root-level directories and their prefixes, missing critical directories like /home, /root, /var, /opt, and /srv, allowing recursive forced removal commands targeting these paths to proceed unchecked. The command line parsing reduces $HOME to an empty token, causing commands like 'rm -rf $HOME' to bypass the dangerous-path test while the shell re-expands the variable at execution. Furthermore, commands such as find with -delete are rated high risk but not disabled, and shred, wipefs, truncate, and pkexec are not handled at all. Since the agent autonomously reads and executes content from external sources including web pages, repository files, and issue text, an indirect prompt injection vulnerability exists that could lead to unattended destructive command execution, resulting in data loss.

This vulnerability allows an attacker to indirectly inject destructive shell commands that bypass the Continue CLI's incomplete denylist protections. As a result, unattended runs of the CLI can execute recursive forced removals of critical user directories and other destructive operations, potentially causing significant data loss for the invoking user. The vulnerability affects the integrity and availability of user data on systems running vulnerable versions of the Continue CLI.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running unattended Continue CLI operations in headless or auto mode, especially when processing untrusted external content. Restricting the CLI's access to critical system directories and monitoring for suspicious command executions may help reduce risk. Review and update denylist policies to include all critical system paths and handle all known destructive commands appropriately.