Tracking: CVE-2026-116109
Severity: Medium (CVSS 3.1: 6.3)
Who is affected
Continue 2.0.0, specifically the MCP Server Transport configuration path. Exposure requires an attacker to influence a connection configuration that the target uses; the CVE assessment includes user interaction.
How the attack works
The reported injection reaches MCPManagerSingleton.setConnections in core/config/ConfigHandler.ts. MCP transport settings determine which local command starts a server. Unsafe handling of attacker-controlled settings can therefore turn a connection setup into operating-system command execution.
Commands run with the Continue process's permissions, including whatever workspace files and credentials that account can access.
What to do
- Allow only reviewed MCP configurations and restrict who can change transport commands or arguments.
- Use a restricted account or container for untrusted projects. Review unexpected child processes and configuration changes before reconnecting servers.
- Follow the vendor and CVE references for a confirmed fix. The reviewed record does not identify a patched release.
Scope and limits
The CVE record links a public proof of concept. That establishes a demonstration, not confirmed exploitation in the wild.