Cline vulnerabilities
We track 3 vulnerabilities in Cline products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 8, 2026.
Latest Cline vulnerabilities
- 8.8 High severity
cline: Origin Validation Error
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header,
- 9.6 Critical severity
cline: Missing Authentication for Critical Functionality
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.
- 9.8 Critical severity
Cline: Improper Control of Generation of Code
DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on string-based parsing to validate commands; while it intercepts dangerous