CVE-2026-76072 affects the Continue CLI, which uses an incomplete denylist as its sole barrier against destructive shell commands in headless and auto (unattended) modes. The default policy grants the Bash tool broad 'allow' permissions, with blocking only occurring when the terminal-security evaluator returns a 'disabled' verdict. The dangerous-path check covers only a limited set of paths, leaving /home, /root, /var, /opt, and /srv unprotected from recursive forced deletion. Shell variable expansion via shell-quote parsing causes $HOME to resolve to an empty token, bypassing the dangerous-path check. Dangerous commands such as shred, wipefs, truncate, and pkexec are entirely unhandled, and find with -delete is merely rated high risk rather than blocked. Because the agent autonomously processes external content including web pages, repository files, and issue text, an indirect prompt injection attack can trigger unattended data destruction. This vulnerability enables an attacker to cause complete data loss for the invoking user through crafted malicious content.
