3vulnerabilities
- Critical1 (33.3%)
- High1 (33.3%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low1 (33.3%)
cline
Ecosystem: npm
Downloads: 338.45 K
- 1CriticalAffects 1 version
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 1LowAffects 1 version
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 1
Vulnerabilities (4)
Known vulnerabilities affecting cline, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-3cj3-hqcr-g934 | High | Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)### Summary The Cline Hub dashboard server (`@cline/cline-hub`), launched via the `cline dashboard` CLI command, accepts WebSocket connections on the `/browser` endpoint without validating the HTTP `Origin` header. When `ROOM_SECRET` is not set—the default for local (`127.0.0.1`) binds—`isAuthorizedBrowserRequest()` returns `true` unconditionally, allowing any website a developer visits to open a cross-origin WebSocket to `ws://127.0.0.1:8787/browser`. An attacker-controlled page can then send `desktopCommand` frames to read workspace/session state, mutate MCP and provider settings, and—becau |
| GitHub (opens in a new tab) | |
| GHSA-5c57-rqjx-35g2 | Critical | Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability## Summary The `kanban` npm package (used by the `cline` CLI) starts a WebSocket server on `127.0.0.1:3484` with no Origin header validation. Any website a developer visits can silently connect to the kanban server via WebSocket and: 1. Leak sensitive data in real-time: workspace filesystem paths, task titles/descriptions, git branch info, AI agent chat messages 2. Hijack running AI agent terminals by injecting arbitrary prompts into the agent's input, leading to remote code execution 3. Kill running agent tasks by terminating active sessions via the control WebSocket WebSocket connections |
| GitHub (opens in a new tab) | |
| GHSA-9ppg-jx86-fqw7 | Low | Unauthorized npm publish of cline@2.3.0 with modified postinstall script### Description On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: cline@2.3.0. The published package contains a modified package.json with an added postinstall script: `"postinstall": "npm install -g openclaw@latest"` This causes openclaw (an unrelated, non-malicious open source package) to be globally installed when cline@2.3.0 is installed. No other files were modified -- the CLI binary (dist/cli.mjs) and all other package contents are identical to the legitimate cline@2.2.3 release. A correct |
| GitHub (opens in a new tab) | |
| MAL-2026-1380 | Unknown | Malicious code in cline (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (38d7531f4d4af07fee607e1d2985d0ea5b41dbf28cca5bc16c8457934e372f86) The package cline was found to contain malicious code. ## Source: ghsa-malware (3c16746b2d863d4c24bbc2297611c642a02942b47d12b675c4a3120911c72eec) ### Description On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: cline@2.3.0. The published package contains a modified package.json with an added postinstall script: `"postinstall": "npm install |
| OSV (opens in a new tab) |
- GHSA-3cj3-hqcr-g934HighCline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
< 3.0.30
### Summary The Cline Hub dashboard server (`@cline/cline-hub`), launched via the `cline dashboard` CLI command, accepts WebSocket connections on the `/browser` endpoint without validating the HTTP `Origin` header. When `ROOM_SECRET` is not set—the default for local (`127.0.0.1`) binds—`isAuthorizedBrowserRequest()` returns `true` unconditionally, allowing any website a developer visits to open a cross-origin WebSocket to `ws://127.0.0.1:8787/browser`. An attacker-controlled page can then send `desktopCommand` frames to read workspace/session state, mutate MCP and provider settings, and—becau
CVE: CVE-2026-59723
- GHSA-5c57-rqjx-35g2CriticalCline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability
<= 2.13.0
## Summary The `kanban` npm package (used by the `cline` CLI) starts a WebSocket server on `127.0.0.1:3484` with no Origin header validation. Any website a developer visits can silently connect to the kanban server via WebSocket and: 1. Leak sensitive data in real-time: workspace filesystem paths, task titles/descriptions, git branch info, AI agent chat messages 2. Hijack running AI agent terminals by injecting arbitrary prompts into the agent's input, leading to remote code execution 3. Kill running agent tasks by terminating active sessions via the control WebSocket WebSocket connections
CVE: CVE-2026-44211
- GHSA-9ppg-jx86-fqw7LowUnauthorized npm publish of cline@2.3.0 with modified postinstall script
>= 2.3.0, < 2.4.0
### Description On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: cline@2.3.0. The published package contains a modified package.json with an added postinstall script: `"postinstall": "npm install -g openclaw@latest"` This causes openclaw (an unrelated, non-malicious open source package) to be globally installed when cline@2.3.0 is installed. No other files were modified -- the CLI binary (dist/cli.mjs) and all other package contents are identical to the legitimate cline@2.2.3 release. A correct
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (38d7531f4d4af07fee607e1d2985d0ea5b41dbf28cca5bc16c8457934e372f86) The package cline was found to contain malicious code. ## Source: ghsa-malware (3c16746b2d863d4c24bbc2297611c642a02942b47d12b675c4a3120911c72eec) ### Description On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: cline@2.3.0. The published package contains a modified package.json with an added postinstall script: `"postinstall": "npm install