Security Digest · Vulnerability record
CVE-2026-44211: Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant.
CVSS 9.6 Critical EPSS 0.2% · p10
Should you act?
Critical and remotely reachable
No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.2%, percentile 10: FIRST’s model estimates a 0.2% chance of exploitation activity in the next 30 days, higher than 10% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.
- Only applies if your dependency tree includes
cline(npm) <= 2.13.0, no fixed version listed. Check your lockfile, including transitive dependencies.
What it is
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.
From the GitHub advisory
Summary
The kanban npm package (used by the cline CLI) starts a WebSocket server on 127.0.0.1:3484 with no Origin header validation. Any website a developer visits can silently connect to the kanban server via WebSocket and:
1. Leak sensitive data in real-time: workspace filesystem paths, task titles/descriptions, git branch info, AI agent chat messages 2. Hijack running AI agent terminals by injecting arbitrary prompts into the agent's input, leading to remote code execution 3. Kill running agent tasks by terminating active sessions via the control WebSocket
WebSocket connections are not subject to CORS restrictions. The browser sends them freely to localhost regardless of the page's origin. The kanban server accepts all connections without checking the Origin header.
Affected Component
Weakness type: CWE-306, CWE-1385.
Product: cline (npm) · Assigned by: GitHub_M · Published: 2026-06-01
Affected and fixed versions
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| npm | cline | <= 2.13.0 | none listed |
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| cline | cline | <= 2.13.0 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_M | 3.1 | 9.6 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Privileges required: none (no login)
- User interaction: required (a user must click/open something)
- Scope: changed (can affect other components)
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
- FIRST EPSS (model of 2026-10-21): 0.21% probability of exploitation activity in the next 30 days; percentile 10.
Timeline
- — GitHub-reviewed advisory GHSA-5c57-rqjx-35g2 published (critical)
- — CVE record published by GitHub_M
- — CVE record last updated
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- GitHub Advisory GHSA-5c57-rqjx-35g2 github.com
- CVE.org record CVE-2026-44211 cve.org
- NVD entry CVE-2026-44211 nvd.nist.gov
Other references from the CVE record and advisory
- github.com github.com