Cline dashboard flaw lets any website run code on developer machines

A security advisory published on 24 September 2026 warns that the Cline Hub dashboard, part of the Cline AI coding tool, can be hijacked by any website a developer visits, allowing attackers to inject malicious commands and achieve arbitrary code execution. The flaw is tracked as CVE-2026-59723 in advisory GHSA-3cj3-hqcr-g934.

According to the advisory, the dashboard server is launched with the cline dashboard command and accepts WebSocket connections on its /browser endpoint without checking the HTTP Origin header. When the ROOM_SECRET environment variable is not set—the default when the dashboard binds to the local address 127.0.0.1—the server's authorisation function returns true unconditionally. The advisory says this lets any page a developer opens in their browser create a cross-origin WebSocket to the running dashboard.

The advisory explains that browsers enforce the same-origin policy for standard web requests but not for WebSocket connections. Browsers always include the Origin header but leave enforcement to the server. Because the Cline Hub server ignores that header, any cross-origin JavaScript can connect, the advisory states.

Once connected, an attacker-controlled page can send desktopCommand frames to read workspace and session state, change MCP and provider settings, and trigger command execution, according to the advisory. It notes that dashboard sessions default to auto-approving all tools, so no confirmation prompt is shown when a provider and model are configured.

The researchers say they dynamically confirmed the attack. An upsert_mcp_server frame injected a malicious stdio MCP server entry into the victim's Cline settings file and returned an ok: true response. The injected entry pointed to a shell command that, according to the advisory, executes under the victim's user account the next time Cline activates the MCP server.

The advisory provides a proof of concept using Cline version 3.0.24 installed globally. In it, the dashboard is started with its defaults—host 127.0.0.1, port 8787 and ROOM_SECRET unset—and a short snippet is pasted into the browser developer console on any non-Cline website. The advisory states the WebSocket connection is accepted without any Origin rejection and the injected MCP entry appears in the settings file.

The advisory also describes a Docker-based reproduction and a Python proof of concept that connects with an Origin header set to a fake attacker domain, sends the same frame, and confirms both the ok: true response and the injected entry. All assertions passed in dynamic testing, according to the advisory.

A remote code execution variant is also described. The advisory says that if the victim has a working AI provider configured, an attacker can send a send frame with auto-approval enabled and a task prompt instructing Cline to run a shell command. Because dashboard-created sessions default to auto-approving all tools, no confirmation is shown.

The advisory lists the affected package as npm/cline and rates the issue as a cross-origin WebSocket hijacking vulnerability. The record marks the status as reported. The advisory does not describe a fix in the material provided.