Skip to content
OpenAdvisories

Package · npm

cline

3 known vulnerabilities.

Malicious versions reported for this package

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.8
    CVE-2026-59723

    Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

    Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header…

    cline cline cline npm
  • Critical 9.6
    CVE-2026-44211

    Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

    Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.

    cline cline cline npm
  • Low —
    GHSA-9ppg-jx86-fqw7

    Unauthorized npm publish of cline@2.3.0 with modified postinstall script

    ### Description On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: cline@2.3.0. The published package contains a modified package.json with an added postinstall…

    cline npm