CVE-2026-116109

Continue workspace MCP configuration can start commands without consent

continuedev · Continue

First documented disclosure · Review checkpoint

Summary

Opening an attacker-controlled workspace can cause Continue to load repository MCP configuration and start a specified local command without the expected consent.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Real-world malicious exploitation is not established by the reviewed primary sources; a vulnerability report or public demonstration is not evidence of a victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Workspace .continue/configs YAML is loaded into MCPManagerSingleton.setConnections, which starts configured stdio MCP transports.

Conditions required

Continue 2.0.0 installed in VS Code and a user opening a malicious repository/workspace containing the configuration. This requires the workspace interaction, not merely an exposed internet port.

Potential impact

Attacker-chosen commands can execute with the developer extension process privileges.

Affected versions and configurations

2.0.0; a broader affected range is not established by the reviewed sources.

Fix and mitigation status

Unknown; no corrected version is identified.

Practical next steps

Do not open untrusted repositories with this affected integration enabled. Review workspace MCP configurations before activation and require an explicit trust decision before starting their commands.

Operating lesson

Repository configuration is untrusted content until a developer approves the executable tools it enables.

Evidence and limits

The public VulDB advisory is dated October 25, one day before the CNA record. September 27 is the private submission date. A public proof of concept is reported; no malicious victim event is established.

Sources