CVE-2026-59723: Cline WebSocket Origin Validation Bypass Allows Local Command Execution

Technical summary

The vulnerability exists in Cline's Hub dashboard server WebSocket handler at the /browser endpoint. The server accepts WebSocket connections without validating the Origin header, failing to enforce proper cross-origin restrictions. When ROOM_SECRET is unset (the default for localhost 127.0.0.1 binds), the isAuthorizedBrowserRequest() function incorrectly permits desktopCommand frames from arbitrary origins. An attacker-controlled website can exploit this by opening a WebSocket to the local dashboard server and sending crafted frames that: (1) read workspace state and configuration, (2) mutate MCP (Model Context Protocol) and provider settings, and (3) trigger arbitrary command execution if a provider or model is already configured. The attack requires user interaction (the user must visit the malicious site while the dashboard is running) but poses significant risk to local development environments. This is classified as an origin validation flaw (CWE-346).

Business impact

For development teams and individual developers using Cline, this vulnerability creates a vector for local privilege escalation and code injection through browser-based attack. A compromised or malicious website visited during active Cline dashboard sessions could exfiltrate sensitive workspace configuration, modify AI tool behavior in ways that introduce vulnerabilities into generated code, or execute arbitrary commands with the privileges of the developer's user account. This is particularly concerning in shared development environments or when developers browse untrusted content while working. The impact extends beyond a single machine if the compromised settings or executed commands affect shared repositories or infrastructure. Organizations deploying Cline for code generation should treat this as a priority patching scenario to avoid supply-chain risks introduced through compromised development tooling.

Affected systems

All installations of Cline prior to version 3.0.30 are affected. This includes Cline deployed as an SDK, as an IDE extension (e.g., in VS Code), or as a CLI assistant when the `cline dashboard` command is invoked. The vulnerability is most readily exploited in default configurations where developers run the dashboard on localhost without setting a ROOM_SECRET environment variable. Development machines, CI/CD environments running Cline dashboard services, and IDE instances with the Cline extension active are all potential targets.

Exploitability

Exploitation requires moderate effort but is feasible for an attacker with basic web development skills. The attacker must: (1) create a malicious website that initiates a WebSocket connection to localhost on the Cline dashboard port, (2) craft valid desktopCommand frames, and (3) trick or socially engineer a developer into visiting the site while the dashboard is running. The attack does not require authentication or special network access—only that the target visit an attacker-controlled website. No known public exploits are documented in the KEV catalog at this time, but the relatively straightforward nature of WebSocket origin validation bypasses suggests that working proof-of-concept code could be developed quickly. Successful exploitation grants broad access to workspace manipulation and command execution, making this a high-confidence, high-impact attack scenario for targeted developers or broad phishing campaigns aimed at development teams.

Remediation

Upgrade Cline to version 3.0.30 or later immediately. This version implements proper Origin header validation for WebSocket connections on the /browser endpoint and corrects the isAuthorizedBrowserRequest() logic to enforce origin-based access control. For users unable to patch immediately, a temporary mitigation is to set a strong ROOM_SECRET environment variable when launching the Cline dashboard; this adds an authentication layer that the vulnerable code path respects. Additionally, restrict access to the Cline dashboard by binding it to 127.0.0.1 only (rather than 0.0.0.0) and consider using a reverse proxy with additional authentication if the dashboard must be accessible over a network.

Patch guidance

Update Cline to version 3.0.30 or later. Verify the update through your IDE extension manager (if using the VS Code extension), package manager (if using as an SDK), or by running `cline --version` (if using the CLI). No breaking changes are documented in this patch. After updating, restart any running instances of the Cline dashboard or your IDE. If you are managing Cline via a package manager or container, ensure your dependency specifications and build artifacts are updated to reference 3.0.30 or a later stable release.

Detection guidance

Monitor for: (1) unexpected WebSocket connections to localhost ports associated with Cline dashboard (default port 3000 or configured alternatives), (2) desktopCommand frames sent to the /browser endpoint without valid Origin headers or with suspicious Origin values, (3) rapid changes to MCP provider or model settings in Cline configuration files, (4) unusual command execution or subprocess spawning from the Cline process or related IDE extensions, and (5) access logs or browser console errors indicating blocked WebSocket connections after patching. For development teams, network segmentation and process monitoring on developer machines can help identify exploitation attempts. Enable audit logging in your IDE and Cline CLI to capture configuration mutations and executed commands.

Why prioritize this

This vulnerability merits immediate priority because: (1) it affects local development infrastructure, which is a high-value target for attackers seeking to inject vulnerabilities or backdoors into source code or artifacts, (2) exploitation is feasible with low attacker sophistication, (3) the impact grants command execution and workspace manipulation—effectively full compromise of the development environment, (4) the patch is non-disruptive and widely available, and (5) development teams are typically more exposed to phishing and malicious websites due to their need to research and integrate third-party tools and libraries. Organizations should prioritize patching developer workstations and CI/CD systems running Cline ahead of general infrastructure updates.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects high exploitability due to low attack complexity, no privilege requirements, and required user interaction balanced against high confidentiality, integrity, and availability impact. The attack vector is adjacent (AV:A), indicating local network or physical proximity; however, in practice, the attack vector is the internet (the malicious website), making it more exploitable in real-world scenarios. The score appropriately captures the severity of arbitrary command execution and configuration tampering in a developer environment, though organizations should also consider the contextual risk based on how widely Cline is deployed in their infrastructure and the sensitivity of code and data in affected workspaces.

Frequently asked questions