Continue CLI Denylist Bypass Enables Prompt-Injection-Triggered Destructive Shell Commands

Technical Analysis

The Bash tool is granted allow-by-default permission in unattended modes, with the only safeguard being isCriticalCommand's dangerous-path regex, which enumerates a narrow set of root-level paths and misses common user data directories (/home, /root, /var, /opt, /srv). Additionally, the command parser (shell-quote) reduces $HOME to an empty token during evaluation, causing rm -rf $HOME to pass the safety check, while the actual shell later re-expands $HOME at execution time, creating a parse/execution mismatch (a TOCTOU-style semantic gap). Commands like find -delete, shred, wipefs, truncate, and pkexec are either underclassified as merely high-risk or unhandled entirely. The entry point is indirect prompt injection: since the agent autonomously ingests untrusted content (fetched web pages, repository files, issue text) and can act on embedded instructions, an attacker can plant a malicious instruction in any such content to cause the agent to execute a destructive command during an unattended/headless run, crossing from a content-ingestion boundary into arbitrary local filesystem destruction.

Affected Systems

Continue CLI

Detection Signatures

• Shell commands invoking rm -rf against $HOME, /home, /root, /var, /opt, or /srv paths in agent execution logs
• Use of find with -delete flag issued by automated/headless agent sessions
• Invocation of shred, wipefs, truncate, or pkexec by unattended CLI agent processes
• Agent tool-call logs showing Bash commands derived from externally fetched content (web pages, issue text, repo files) without human approval
• Unattended/headless mode sessions where Bash permission defaults to 'allow' without per-command human confirmation

Remediation Steps

1. 1

   Replace denylist with allowlist model

   Switch from blocking known-bad commands to only permitting a vetted, narrow set of safe shell operations in unattended/headless/auto modes.

2. 2

   Evaluate commands post-expansion

   Perform dangerous-path and destructive-command checks after full shell variable expansion (matching actual execution semantics) rather than on the raw parsed token stream.

3. 3

   Expand critical path and command coverage

   Add /home, /root, /var, /opt, /srv, and their subpaths to disabled patterns; reclassify find -delete, shred, wipefs, truncate, and pkexec as disabled rather than merely high-risk.

4. 4

   Require human confirmation for destructive operations

   Force interactive approval or hard-block any recursive delete, disk-wipe, or privilege-escalation command regardless of mode, especially when the command originates from agent reasoning over untrusted content.

5. 5

   Sandbox unattended execution

   Run headless/auto-mode agent sessions in a restricted, ephemeral filesystem/container with least-privilege access so destructive commands cannot affect persistent user data.

6. 6

   Treat fetched content as untrusted input

   Apply content provenance tagging and prompt-injection filtering to web pages, repo files, and issue text before allowing them to influence tool-invocation decisions.