OS Command Injection Vulnerability in Continuedev Continue 2.0.0
CVE-2026-116109

5.3MEDIUM

Key Information:

Vendor

Continuedev

Status
Continue
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116109?

A security flaw has been identified in Continuedev Continue 2.0.0, specifically associated with the MCPManagerSingleton.setConnections function in the core/config/ConfigHandler.ts file. This vulnerability enables an attacker to perform remote OS command injection, potentially allowing unauthorized commands to be executed on the server. Despite early notifications to the vendor about this serious issue, there was no response. The public disclosure of this exploit raises significant concerns for users and organizations relying on this software.

Affected Version(s)

Continue 2.0.0

References

https://vuldb.com/vuln/426177
vdb-entrytechnical-description
https://vuldb.com/vuln/426177/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116109
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

scription (VulDB User)
VulDB CNA Team
.