---
id: "CVE-2026-116109"
kind: "vulnerability"
aliases: ["CVE-2026-116109"]
title: "Continue 2.0.0: MCP server transport config allows remote OS command injection"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Continue", "fixed": [], "affected": "2.0.0", "ecosystem": "vscode"}]
ecosystems: []
tags: ["ai-tooling", "continue", "developer-workstations", "jetbrains", "mcp", "vscode"]
not_affected_if: ["default-config", "no-mcp-servers"]
published_at: "2026-10-26T03:17:10+00:00"
first_seen_at: "2026-10-26T03:39:26+00:00"
updated_at: "2026-10-26T03:40:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116109", "first_seen_at": "2026-10-26T03:39:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-26T03:40:48+00:00"}]
---

# Continue 2.0.0: MCP server transport config allows remote OS command injection

Continue 2.0.0 passes MCP server transport settings through MCPManagerSingleton.setConnections in core/config/ConfigHandler.ts without sanitizing them. A remote attacker who can supply that configuration can inject OS commands that run on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vscode:Continue affected 2.0.0 fixed ?

## How to check

- Check the installed Continue extension version (VS Code or JetBrains) for 2.0.0.
- Review mcpServers entries in Continue config (config.yaml, .continue/mcpServers, workspace .continue folder) for command/args values you did not write, especially ones that came from a cloned repo or shared config.
- Treat any MCP server definition from an untrusted repo as code that will run on your machine.

## Fix

unknown: no vendor fix or advisory found. Vendor did not respond to disclosure. Nothing in the 2.1.0-vscode pre-release notes mentions this.

## Timeline

- 2026-10-26T03:39:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116109
- 2026-10-26T03:40:48+00:00 analyst — Only secondary source found (VulDB VDB-426177): Continue 2.0.0, setConnections in ConfigHandler.ts, CWE-78, remote, needs user interaction, PoC claimed but no link found, vendor never responded, no fix/advisory. Exact trigger not published (VulDB says 'unknown input'). Continue VS Code 2.0.0 released 19 Jun 2026, 2.1.0 is a pre-release with no stated security fix. Nothing verified.

## Documents

- [advisory] VDB-426177: Continue 2.0.0 MCP Server Transport os command injection https://vuldb.com/vuln/426177
- [mentions] continuedev/continue releases https://github.com/continuedev/continue/releases

## From the sources

A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_