---
id: 2026-10-continue-cli-bash-rule-chaining-bypass-vulncheck-agent-sandbox-batch
title: "Continue CLI runs chained commands past its Bash allow rules and denylist (CVE-2026-109560, CVE-2026-76072), no fix; VulnCheck batch adds sandboxed.sh, deepsec, Network-AI"
date_disclosed: 2026-10-12
last_updated: 2026-10-13
severity: high
status: active
ecosystems: [npm, ai-agents, claude-code, coding-agents, sandbox, mcp]
tools_affected: ["Continue CLI (@continuedev/cli) through 1.5.47, the current release (both CVEs; no fix)", "sandboxed.sh / Orb backend (Th0rgal/orb) through 1.3.0 per the record (container workspaces; fix is an opt-in flag, off by default)", "Vercel deepsec 0.1.0 through 1.1.16 (fixed 1.1.17; npm latest 2.3.10)", "Network-AI (npm network-ai) 5.14.0 through 5.15.1 (ClaudeHookBridge deny-pattern bypass) and 5.0.0 through 5.15.1 (dashboard WebSocket hijack), fixed 5.15.2", "any Claude Code setup that relies on Network-AI's PreToolUse hook as a hard gate"]
tags: [cve, cna-wave, vulncheck, coding-agent, permission-bypass, prompt-injection, command-chaining, denylist, headless-mode, sandbox-escape, container-escape, symlink, link-following, agent-hooks, claude-code, no-fix, incomplete-fix]
---

## TL;DR
On 2026-10-12 VulnCheck published a further block of CVE records against agent tooling, and four of them concern products this corpus's readers run. **Continue CLI**, the terminal agent of the Continue IDE project, matches a static `Bash(prefix*)` allow rule against the whole command line, so a command chained after an allowed prefix with `;`, `&&` or `|` runs without the confirmation the dynamic evaluator would have asked for (**CVE-2026-109560**, CVSS 4.0 7.7). An older record, **CVE-2026-76072** (8.3, published 2026-08-24 and untracked here until today), says the destructive-command denylist that is the only barrier in headless and auto mode misses most of the filesystem and misparses a home-directory variable. Both GitHub issues (opened 2026-07-19 and 2026-09-17) are open with no maintainer reply, npm's latest `@continuedev/cli` is still 1.5.47 from 2026-06-18, and the vendor's security tab is empty. **sandboxed.sh**, the Rust backend behind the Orb desktop and iOS clients that run Claude Code, Codex, OpenCode and other agents on remote machines, attached shells to container workspaces with `nsenter` and without `--root`, so agent-run code resolved absolute paths on the host and could read and rewrite host files (**CVE-2026-109569**, 9.3); the fix commit makes the hardened behaviour an environment flag that is off by default. **Vercel deepsec**, the agent-powered vulnerability scanner, extracted result tarballs from its sandboxes with plain `tar`, so a prompt-injected agent in the sandbox could plant a symlink and write files on the orchestrator host (**CVE-2026-109375**, 4.9); fixed in 1.1.17 in May, record published now. **Network-AI**'s `ClaudeHookBridge`, a PreToolUse hook sold as an operator-facing hard gate for Claude Code, checked deny patterns against only the first candidate field of a tool call, so a payload in a `Write` body beside a benign path passed (**CVE-2026-109331**, 7.5; vendor 8.4), fixed 5.15.2 on 2026-09-27 as the second fix of the same control. If you run Continue CLI unattended on content you do not control, stop until a release carries a fix; everything else here is an upgrade or a flag.

## What happened

The GitHub Advisory Database's `agent` and `mcp` listings on 2026-10-13 showed unreviewed rows dated 2026-10-12 with no package metadata, the shape the [10-10 and 10-11 wave](2026-10-vulncheck-single-researcher-agent-mcp-gateway-cve-wave-mini-swe-agent-env-leak.md) had. The CNA is VulnCheck on every record below, the references are issues, permalinks and vendor advisories, and the scores are VulnCheck's unless stated. These four are the ones with an audience here; the same listings' EdgeEver, conductor-oss ([updated in its own file](2026-09-orkes-conductor-graalvm-workflow-rce-exploited.md)), FreeRDP and OTRS rows are out of scope.

### Continue CLI: two unfixed records, the current release affected by both

| CVE | Published | CVSS 4.0 (3.1) | What the record says | Vendor signal |
|---|---|---|---|---|
| CVE-2026-109560 | 2026-10-12 | 7.7 (7.5) | The permission system approves Bash commands by allowed prefix rules. The check does not account for `;`, `&&` or `|` after an approved prefix, so commands appended after it run without separate authorization. An attacker who can place instructions in repository files or fetched pages can make the agent append such commands and run code as the user. CWE-863. Credit Akıner Kısa and Tardfyou. Code cited: `extensions/cli/src/permissions/permissionChecker.ts` lines 162 to 174 and `policyWriter.ts` lines 18 to 31 at commit `d3f60ba`. | [Issue #13288](https://github.com/continuedev/continue/issues/13288), opened 2026-09-17 by Tardfyou: the static allow matches the entire command string and overrides the dynamic security evaluator's "ask" verdict. Open, no labels, no assignee, no linked pull request, no maintainer comment (2026-10-13). |
| CVE-2026-76072 | 2026-08-24 | 8.3 (7.4) | In headless and auto mode the default policy allows the Bash tool, and the only hard block is the terminal-security evaluator's `isCriticalCommand`. Its dangerous-path test covers `/`, `~`, `/usr`, `/etc`, `/bin` and `/sbin`, so recursive deletion of `/home`, `/root`, `/var`, `/opt` or `/srv` is not disabled; the parser reduces a home-directory variable to an empty token the shell later expands; `find -delete` is rated high risk rather than disabled; `shred`, `wipefs`, `truncate` and `pkexec` are not handled. An indirect prompt injection in content the agent reads can make an unattended run destroy the invoking user's data. CWE-184. Credit George Chen. | [Issue #13001](https://github.com/continuedev/continue/issues/13001), opened 2026-07-19 by geo-chen after an email on 2026-06-13 got no response. Open, `kind:bug` from a bot, no maintainer comment; a fork commit on 2026-07-22 widens the denylist but is not a pull request. |

Registry facts, checked 2026-10-13: `@continuedev/cli` latest is 1.5.47, published 2026-06-18, four releases in 2026; 4,038 downloads in the week of 2026-10-05. `continuedev/continue` has no published security advisories. Both affected ranges are "through 1.5.47," which is every version that exists.

The two findings compose. The first lets injected text run a command the operator never allowed in interactive use; the second says that in unattended use the allow list is already open and the denylist underneath it is partial. The reporter of the first argues the fix is to split compound commands and let the most restrictive verdict win; a community comment on each issue argues a string denylist cannot be made complete and the evaluator should resolve the command and validate arguments against tool schemas. Neither view has a maintainer response.

### sandboxed.sh (Orb): the fix is a flag, and the flag is off

CVE-2026-109569 (published 2026-10-12, CVSS 4.0 9.3, 3.1 8.8, CWE-1188): "code in container workspaces can access the host filesystem because `nsenter` attaches without `--root`. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation." The record's `affected.vendor` is Th0rgal, the product sandboxed.sh, the range "through 1.3.0," and the repository `Th0rgal/orb`.

The referenced commit, "Harden deploy path: scoped nsenter root + versioned-symlink binary install," adds `SANDBOXED_SH_NSENTER_USE_TARGET_ROOT=1`, which appends `--root` to the `nsenter` arguments in `build_nsenter_command` so the attached shell sees only the container filesystem. The author's commit message says the change followed "a case where a mission escaped its container and rewrote host files," and that the flag stays off until each host has the agent binaries (Claude, Codex, OpenCode, MCP) inside the container, because with the host root hidden those binaries are no longer reachable. The commit page shows no date. The repository describes Orb as a desktop and iOS client for managing AI providers, machines and coding agents, with sandboxed.sh as its Rust backend; it runs Claude Code, Codex, Antigravity, OpenCode and Grok locally or on remote machines, "either on the configured host or in an isolated container workspace," and lists Hermes, ChatGPT, Grok Bot and Cursor Cloud as cloud agents. 530 stars.

Two things do not line up and are recorded rather than resolved. The releases page's newest tag is v0.12.0 (16 May, no year shown) and none of the ten releases shown mentions `nsenter`, `--root` or security, while the CNA range says "through 1.3.0"; the record's version source is not stated. And "fixed" here means a default-off environment variable, so a deployment that upgrades and does nothing else keeps the escape. There is no npm or PyPI package named sandboxed.sh; the product is installed from the repository. Status for this item: mitigated only where the operator sets the flag.

### Vercel deepsec: a May fix, a November-shaped record

CVE-2026-109375 (published 2026-10-12, CVSS 4.0 4.9, 3.1 6.1, CWE-59): `extractTarballLocally` in deepsec 0.1.0 before 1.1.17 "allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Attackers controlling sandbox code, such as a prompt-injected coding agent, can plant symbolic or hard links in the host data directory to write arbitrary files on the orchestrator host." The record names 1.1.17 as unaffected.

deepsec is Vercel Labs' "security harness for finding vulnerabilities in your codebase powered by coding agents" (8.1k stars, npm `deepsec`, latest 2.3.10 on 2026-10-13). Its README describes fanning large scans out to Vercel Sandbox microVMs: the working tree goes up as a tarball, the agents run inside, and results come back as tarballs that the orchestrator extracts. The threat model the README states is that the sandbox is untrusted and the orchestrator host is not. The referenced pull request #46 (aydinnyunus, opened 2026-05-05, not merged as of 2026-10-13) proposed switching to `node-tar` and rejecting symlink and hard-link members; the maintainer's pull request #47 ("Improve windows compat and make tar usage more robust," merged 2026-05-05) added `tar@7.5.13` as a dependency with a commit titled "Support stricter tar," and the referenced commit `c5a4e42` is on `main`. The record's fixed version, 1.1.17, is from May; the CVE is from October. Anyone on 1.1.17 or later, which npm has served since then, is past it. Status for this item: patched.

### Network-AI: an incomplete fix to a Claude Code hard gate, fixed again

Network-AI is an npm package whose `network-ai hook pre-tool-use --deny ...` command installs a PreToolUse hook for Claude Code and is documented as an operator-facing hard security gate; deny patterns are checked first and in the default `observe` mode are the only hard block. Three CVE records on 2026-10-12 at 16:05 UTC point at three vendor advisories published 2026-09-27:

| CVE | VulnCheck CVSS 4.0 (3.1) | Vendor GHSA and score | Affected, fixed | Finding |
|---|---|---|---|---|
| CVE-2026-109331 | 7.5 (7.4) | [GHSA-9p2w-prp8-5722](https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-9p2w-prp8-5722), High, CVSS 3.1 8.4 | 5.14.0 to 5.15.1, fixed 5.15.2 | `extractFullTarget` returns the first present field from a fixed candidate list and falls back to the full input only when none exists. A tool whose dangerous content sits in a non-first field (a `Write` body, an MCP script parameter) beside a benign `file_path` or `command` is matched on the benign value only, so a deny rule meant to block execution or file writes is bypassed. The vendor says the earlier fix for GHSA-743h-jr5x-mpcr addressed truncation and left this selection logic in place, making this an incomplete fix of the same control. Reporter zx (Jace), @manus-use. |
| CVE-2026-109330 | 5.3 (4.3) | GHSA-hr6v-mfxm-4438 | 5.0.0 to 5.15.1, fixed 5.15.2 | `DashboardServer.handleUpgrade` validates neither Origin nor a token, so a page the operator visits can open a WebSocket to the loopback dashboard and read agent ids, roles, task descriptions and token budgets. |
| CVE-2026-109332 | 2.3 (3.1) | GHSA-4pvg-m42h-c3x2 | before 5.15.2 | `McpSseServer._handleRequest` reflects any localhost Origin into `Access-Control-Allow-Origin` regardless of the bind interface, so when bound to a non-loopback address an attacker page with a localhost Origin reads unauthenticated endpoints cross-origin. |

Registry: `network-ai` 5.15.2 published 2026-09-27, latest 5.15.4 on 2026-09-29. The vendor rated the hook bypass 8.4 and VulnCheck 7.5; both are shown because the difference is the attack vector (the vendor assumes a local caller, VulnCheck's 4.0 vector has `AT:P`). Status for this item: patched. Why it is here: a hook that an operator installs to make Claude Code's deny rules hard is the kind of control [LEARNINGS-class "tool definitions are documentation"](2026-05-trustfall-mcp-auto-execute.md) findings keep reaching, and the fix had to be done twice.

## Am I affected?

```bash
# Continue CLI: any installed version is affected by both records
npm ls -g @continuedev/cli 2>/dev/null; cn --version 2>/dev/null
# Where it runs unattended: look for headless / auto invocations in CI and cron
grep -rn --include='*.yml' --include='*.yaml' --include='*.sh' -E 'cn (-p|--headless|--auto)|continuedev/cli' . 2>/dev/null | head
# Permission rules with wildcard Bash prefixes (the chaining bypass needs one)
grep -rn 'Bash(' ~/.continue 2>/dev/null | head

# Orb / sandboxed.sh: is the hardened nsenter path on?
grep -rn 'SANDBOXED_SH_NSENTER_USE_TARGET_ROOT' /etc/systemd /etc/default ~/.config 2>/dev/null
# unset or anything but 1 means container workspaces see the host root

# deepsec: below 1.1.17 is affected
npm ls deepsec 2>/dev/null; npm ls -g deepsec 2>/dev/null   # local metadata only; do not use npx, which can fetch and run the latest package

# Network-AI: below 5.15.2 has the hook bypass; check the installed hook too
npm ls -g network-ai 2>/dev/null
grep -n 'network-ai' ~/.claude/settings.json .claude/settings.json 2>/dev/null
```

## If you are affected

1. **Continue CLI, unattended use:** stop running it in headless or auto mode on repositories, pages or issues you do not control until a release names a fix for both issues. Where it must run, run it in a throwaway container with no credentials and no writable mount of anything you keep: [prevention/agent-sandboxing.md](../prevention/agent-sandboxing.md).
2. **Continue CLI, interactive use:** remove wildcard `Bash(prefix*)` allow rules. Every allowed prefix is a chaining point until the matcher splits compound commands.
3. **Orb / sandboxed.sh:** set `SANDBOXED_SH_NSENTER_USE_TARGET_ROOT=1` once the agent binaries are inside the container image, restart, and verify from inside a workspace that host paths no longer resolve. Treat any host where a mission ran on an untrusted task before that as touched: [playbooks/if-your-local-ai-agent-was-exploited.md](../playbooks/if-your-local-ai-agent-was-exploited.md).
4. **deepsec:** upgrade past 1.1.17 (current is 2.3.10) and check the orchestrator host's data directory for links the sandboxes did not create.
5. **Network-AI:** upgrade to 5.15.2 or later and re-read your deny rules against the new matcher; a rule that only names a `command` field never covered `Write` bodies.

## Prevention

- **A prefix allow list is not a parser.** Agent permission systems that approve by string prefix need to tokenize the command, apply the rule to every segment, and let the most restrictive verdict win. This is the third coding-agent tool in this corpus with a chaining or prefix bypass after [Claude Code's `find` confirmation bypass](2026-08-claude-code-desktop-ghsa-batch.md) and [Gemini CLI's headless workspace-trust RCE](2026-04-gemini-cli-trustissues-cve-2026-12537.md): [prevention/agent-sandboxing.md](../prevention/agent-sandboxing.md).
- **A denylist in unattended mode is a list of what the attacker may not say, not of what the attacker may not do.** Unattended runs need a container with no credentials and a read-only host, not a longer list.
- **Container isolation that leaves the host root mounted is not isolation.** For any agent runner that "attaches" to a container, check the mount and root namespace it attaches with, and prefer running the agent binary inside the image.
- **Result artefacts from a sandbox are untrusted input to the host.** Extract with a library that rejects links and absolute paths, into a directory the host does not execute from: [prevention/ci-cd-hardening.md](../prevention/ci-cd-hardening.md).

## Sources
- CVE Services (CNA: VulnCheck), fetched 2026-10-13, the ranges, scores, vectors, CWEs, descriptions and references above: [CVE-2026-109560](https://cveawg.mitre.org/api/cve/CVE-2026-109560) (Continue CLI chaining, published 2026-10-12 20:55 UTC), [CVE-2026-76072](https://cveawg.mitre.org/api/cve/CVE-2026-76072) (Continue CLI denylist, published 2026-08-24), [CVE-2026-109569](https://cveawg.mitre.org/api/cve/CVE-2026-109569) (sandboxed.sh), [CVE-2026-109375](https://cveawg.mitre.org/api/cve/CVE-2026-109375) (deepsec), [CVE-2026-109331](https://cveawg.mitre.org/api/cve/CVE-2026-109331), [CVE-2026-109330](https://cveawg.mitre.org/api/cve/CVE-2026-109330) and [CVE-2026-109332](https://cveawg.mitre.org/api/cve/CVE-2026-109332) (Network-AI).
- [VulnCheck — Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining](https://www.vulncheck.com/advisories/continue-cli-through-1.5.47-bash-permission-rule-bypass-via-command-chaining) — fetched 2026-10-13: dated 10/12/2026, CWE-863, 7.7, credit Akıner Kısa and Tardfyou, no fixed version, no vendor timeline. [VulnCheck — Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode](https://www.vulncheck.com/advisories/continue-cli-through-incomplete-destructive-command-denylist-in-headless-and-auto-mode) — fetched 2026-10-13: dated 8/24/2026, CWE-184, 8.3, credit George Chen, no fixed version.
- [continuedev/continue — issue #13288](https://github.com/continuedev/continue/issues/13288) — fetched 2026-10-13: opened 2026-09-17, open, the static-allow-wins mechanism, no maintainer reply. [continuedev/continue — issue #13001](https://github.com/continuedev/continue/issues/13001) — fetched 2026-10-13: opened 2026-07-19, the 2026-06-13 email with no response, open, `kind:bug`, no linked pull request. [continuedev/continue security advisories](https://github.com/continuedev/continue/security/advisories) — fetched 2026-10-13: empty.
- [GitHub Advisory Database — GHSA-f54m-g39v-qf2p](https://github.com/advisories/GHSA-f54m-g39v-qf2p) (Continue CLI), [GHSA-xqq7-hjvp-gg2f](https://github.com/advisories/GHSA-xqq7-hjvp-gg2f) (sandboxed.sh), [GHSA-cchp-25pr-r776](https://github.com/advisories/GHSA-cchp-25pr-r776) (deepsec), [GHSA-8x93-4278-4f5c](https://github.com/advisories/GHSA-8x93-4278-4f5c) (Network-AI) — fetched 2026-10-13: all unreviewed, no package or ecosystem shown, published 2026-10-12.
- [Th0rgal/orb — commit 4ab42e9 "Harden deploy path: scoped nsenter root + versioned-symlink binary install"](https://github.com/Th0rgal/orb/commit/4ab42e91b16c452f77d93ca69a040a54229b0aa2) — fetched 2026-10-13: the opt-in `SANDBOXED_SH_NSENTER_USE_TARGET_ROOT` flag, the "mission escaped its container and rewrote host files" note, the reason the flag stays off, no date shown. [Th0rgal/orb repository](https://github.com/Th0rgal/orb) and [releases](https://github.com/Th0rgal/orb/releases) — fetched 2026-10-13: the product description, the agent list, 530 stars, newest tag v0.12.0, no security release.
- [vercel-labs/deepsec repository](https://github.com/vercel-labs/deepsec) — fetched 2026-10-13: the description, the sandbox and orchestrator model from the README, 8.1k stars, npm `deepsec`. [Pull request #46](https://github.com/vercel-labs/deepsec/pull/46) (opened 2026-05-05, not merged, the proposed link-rejecting extractor) and [pull request #47](https://github.com/vercel-labs/deepsec/pull/47) (merged 2026-05-05, "Support stricter tar," `tar@7.5.13` added) — fetched 2026-10-13.
- [Jovancoding/Network-AI — GHSA-9p2w-prp8-5722](https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-9p2w-prp8-5722) — fetched 2026-10-13: published 2026-09-27, High, CVSS 3.1 8.4, CWE-436 and CWE-863, affected 5.14.0 to 5.15.1, patched 5.15.2, the first-candidate-field mechanism, the GHSA-743h-jr5x-mpcr incomplete-fix statement, reporter zx (Jace).
- Registries, checked 2026-10-13: `npm view @continuedev/cli time` (1.5.47 on 2026-06-18, latest), `api.npmjs.org` last-week downloads for `@continuedev/cli` (4,038, 2026-10-05 to 10-11), `npm view network-ai time` (5.15.2 on 2026-09-27, 5.15.4 latest on 2026-09-29), `npm view deepsec version` (2.3.10), `npm view sandboxed.sh` (404) and `pip index versions sandboxed-sh` (no distribution).
- Related in this corpus: [the 10-10 to 10-12 VulnCheck wave](2026-10-vulncheck-single-researcher-agent-mcp-gateway-cve-wave-mini-swe-agent-env-leak.md) (same CNA, same listing shape, mini-swe-agent and mistral.rs sandbox findings), [Claude Code and Desktop GHSA batch](2026-08-claude-code-desktop-ghsa-batch.md), [Gemini CLI TrustIssues, CVE-2026-12537](2026-04-gemini-cli-trustissues-cve-2026-12537.md), [Trustfall MCP auto-execute](2026-05-trustfall-mcp-auto-execute.md).