CVE-2026-59723 Details
Description
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOM_SECRET is unset for local 127.0.0.1 binds, isAuthorizedBrowserRequest() allows attacker-controlled websites to send desktopCommand frames that read workspace state, mutate MCP and provider settings, and trigger command execution when a provider or model is configured. This issue is fixed in version 3.0.30.
A cross-origin WebSocket hijacking vulnerability has been identified in the Cline Hub dashboard server, specifically in versions prior to 3.0.30. The issue arises because the server accepts WebSocket connections on the '/browser' endpoint without validating the 'Origin' header. When the 'ROOM_SECRET' environment variable is unset, which is the default for local '127.0.0.1' binds, the 'isAuthorizedBrowserRequest()' function allows any website to send commands that can read and modify the user's workspace and provider settings. This vulnerability could be exploited to execute arbitrary commands through the Cline application.
Users can update to Cline version 3.0.30 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cline/cline/security/advisories/GHSA-3cj3-hqcr-g934 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/cline/cline/commit/d09270940f5746f288cfc4a5039b46a2f4d5d01e | [email protected] | Patch |
| https://github.com/cline/cline/pull/11724 | [email protected] | Issue TrackingPatch |
| https://github.com/cline/cline/releases/tag/cli-v3.0.30 | [email protected] | Release Notes |
| https://github.com/cline/cline/security/advisories/GHSA-3cj3-hqcr-g934 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cline cline | < 3.0.30 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 26, 2026 | Initial Analysis | [email protected] |
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |