{"id":"CVE-2026-116109","kind":"vulnerability","aliases":["CVE-2026-116109"],"related":[],"title":"Continue 2.0.0: MCP server transport config allows remote OS command injection","description":"A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Continue 2.0.0 passes MCP server transport settings through MCPManagerSingleton.setConnections in core/config/ConfigHandler.ts without sanitizing them. A remote attacker who can supply that configuration can inject OS commands that run on the host.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Continue","fixed":[],"affected":"2.0.0","ecosystem":"vscode"}],"ecosystems":[],"tags":["ai-tooling","continue","developer-workstations","jetbrains","mcp","vscode"],"not_affected_if":["default-config","no-mcp-servers"],"how_to_check":"- Check the installed Continue extension version (VS Code or JetBrains) for 2.0.0.\n- Review mcpServers entries in Continue config (config.yaml, .continue/mcpServers, workspace .continue folder) for command/args values you did not write, especially ones that came from a cloned repo or shared config.\n- Treat any MCP server definition from an untrusted repo as code that will run on your machine.","fix":"unknown: no vendor fix or advisory found. Vendor did not respond to disclosure. Nothing in the 2.1.0-vscode pre-release notes mentions this.","status":"open","published_at":"2026-10-26T03:17:10+00:00","first_seen_at":"2026-10-26T03:39:26+00:00","triaged_at":"2026-10-26T03:40:00+00:00","updated_at":"2026-10-26T03:40:48+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-26T03:40:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Continue 2.0.0: MCP server transport config allows remote OS command injection","impact":"high","summary":"Continue 2.0.0 passes MCP server transport settings through MCPManagerSingleton.setConnections in core/config/ConfigHandler.ts without sanitizing them. A remote attacker who can supply that configuration can inject OS commands that run on the host.","category":"ai-tooling","nicknames":[],"who_cares":["ai-tooling","mcp","continue","vscode","jetbrains","developer-workstations"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs OS commands on the developer's machine via MCP config.","analyst_note":"Confirm the exact trigger in ConfigHandler.ts setConnections, whether a fixed version exists, and whether the vendor has responded; check the NVD page and the linked disclosure.","how_to_check":"- Check the installed Continue version, for example in the VS Code or JetBrains extension list, and whether it is `2.0.0`.\n- Look for MCP server entries in the Continue config file that point to untrusted sources.","needs_analyst":true,"not_affected_if":["default-config","no-mcp-servers"],"who_is_affected":"Teams running Continue 2.0.0 with MCP servers configured, especially where the configuration can be influenced by a repository, a shared config, or a remote source. Installs without MCP server transports configured are likely not reachable through this path, but the sources do not confirm that. The sources say the vendor did not respond to disclosure, so no patch is confirmed.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000631,"input_tokens":3347,"output_tokens":592,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the exact trigger in ConfigHandler.ts setConnections, whether a fixed version exists, and whether the vendor has responded; check the NVD page and the linked disclosure.","search":"'-116109':14A,17A '-2026':13A,16A '2.0.0':2A,30B,68C 'affect':71C 'ai':20B 'ai-tool':19B 'allow':7A 'attack':45B,93C 'command':10A,54B,90C 'compon':81C 'config':6A 'configur':50B 'contact':113C 'continu':1A,22B,29B,67C 'continue':18A 'continuedev':66C 'core/config/confighandler.ts':39B,78C 'cve':12A,15A 'develop':24B 'developer-workst':23B 'disclos':102C 'disclosur':117C 'earli':114C 'execut':96C 'exploit':99C 'file':77C 'found':64C 'function':73C 'host':59B 'inject':11A,52B,91C 'jetbrain':26B 'lead':87C 'manipul':86C 'may':107C 'mcp':3A,27B,32B,82C 'mcpmanagersingleton.setconnections':37B,74C 'os':9A,53B,89C 'pass':31B 'public':105C 'remot':8A,44B,97C 'respond':121C 'run':56B 'sanit':41B 'server':4A,33B,83C 'set':35B 'suppli':48B 'tool':21B 'transport':5A,34B,84C 'use':109C 'vendor':111C 'vscode':28B 'vulner':61C,70C 'way':124C 'without':40B 'workstat':25B","nicknames":[],"mitigations":[],"who_affected":"Teams running Continue 2.0.0 with MCP servers configured, especially where the configuration can be influenced by a repository, a shared config, or a remote source. Installs without MCP server transports configured are likely not reachable through this path, but the sources do not confirm that. The sources say the vendor did not respond to disclosure, so no patch is confirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T03:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116109","severity":null,"published_at":"2026-10-26T03:17:10+00:00","modified_at":"2026-10-26T03:17:10+00:00","first_seen_at":"2026-10-26T03:39:26+00:00","fetched_at":"2026-10-26T03:39:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116109:826","url":null,"severity":null,"published_at":"2026-10-26T03:40:48+00:00","modified_at":"2026-10-26T03:40:48+00:00","first_seen_at":"2026-10-26T03:40:48+00:00","fetched_at":"2026-10-26T03:40:48+00:00","note":"Only secondary source found (VulDB VDB-426177): Continue 2.0.0, setConnections in ConfigHandler.ts, CWE-78, remote, needs user interaction, PoC claimed but no link found, vendor never responded, no fix/advisory. Exact trigger not published (VulDB says 'unknown input'). Continue VS Code 2.0.0 released 19 Jun 2026, 2.1.0 is a pre-release with no stated security fix. Nothing verified."}],"documents":[{"id":3706,"url":"https://vuldb.com/vuln/426177","title":"VDB-426177: Continue 2.0.0 MCP Server Transport os command injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3708,"url":"https://github.com/continuedev/continue/releases","title":"continuedev/continue releases","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}