CVE-2026-59723 json
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
published 4mo ago modified last mo. also EUVD-2026-42475 , GHSA-3cj3-hqcr-g934
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOM_SECRET is unset for local 127.0.0.1 binds, isAuthorizedBrowserRequest() allows attacker-controlled websites to send desktopCommand frames that read workspace state, mutate MCP and provider settings, and trigger command execution when a provider or model is configured. This issue is fixed in version 3.0.30.
Patch / fix
- npm cline 3.0.30
- cline cline 3.0.30
- github.com/cline/cline@d092709 commit
- github.com/cline/cline#11724 pull request
- github.com/cline/cline/releases/tag/cli-v3.0.30 release
Is CVE-2026-59723 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 4mo ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- github.com https://github.com/cline/cline/security/advisories/GHSA-3cj3-hqcr-g934 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | cline | <3.0.30 |
3.0.30 |
Affected products
- cline cline
Classification
- Weakness
-
- CWE-346 Origin Validation Error
References
-
github.com
/cline/cline/pull/11724
web, issue-tracking, patch
-
github.com
/cline/cline/commit/d09270940f5746f288cfc4a5039b46a2f4d5d01e
web, patch
-
github.com
/cline/cline/security/advisories/GHSA-3cj3-hqcr-g934
exploit, web, vendor-advisory
-
github.com
/cline/cline/releases/tag/cli-v3.0.30
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-59723
advisory
-
github.com
/cline/cline
package
Sources
- CVE List CVE-2026-59723
- GitHub Advisory GHSA-3cj3-hqcr-g934
- NVD CVE-2026-59723
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.