Loading story…
Cline disclosed and fixed CVE-2026-59723, a high-severity cross-origin WebSocket hijacking flaw in the Hub dashboard server started by the cline dashboard command. In versions before 3.0.30, the /browser WebSocket endpoint failed to properly validate the Origin header, and authorization could be bypassed when ROOM_SECRET was unset for local 127.0.0.1 binds. A malicious website could abuse the weakness to send desktopCommand frames to the local dashboard, exposing workspace state, changing MCP and provider settings, and potentially triggering command execution when a provider or model was configured.
The fix landed through pull request #11724 and commit d09270940f5746f288cfc4a5039b46a2f4d5d01e, which added host and origin allowlists, enforced authentication for WebSocket upgrades, unsafe HTTP methods, and non-public routes, and required a matching room secret when configured. The patch also normalized public URL handling for localhost and direct IP access, while tests were added to verify trusted local origins and reject untrusted hosts and origins. Cline advised users to upgrade to 3.0.30, set ROOM_SECRET when the dashboard is not strictly local, validate origins, and limit provider and model configurations to reduce exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE for a high-severity cross-origin WebSocket hijacking vulnerability in Cline before version 3.0.30 was published. The advisory states the issue affects the `/browser` endpoint in the Cline Hub dashboard and is fixed in version 3.0.30.
A source code commit added browser-to-desktop request authorization controls to the Cline Hub dashboard server, including host and origin allowlists, authentication for WebSocket upgrades and non-public routes, and related tests.
A pull request was published showing changes to tighten browser-to-server WebSocket and HTTP request validation in the Cline Hub dashboard, including Host and Origin checks and optional roomSecret enforcement for sensitive requests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The open-source AI coding assistant **Cline** has faced two serious security incidents affecting developers: a supply-chain compromise of its npm distribution and a critical local WebSocket vulnerability that can lead to remote code execution. In the npm incident, an unauthorized actor published `cline@2.3.0`, which silently installed the **OpenClaw** package on user systems through the Cline CLI installation path. Maintainers said the malicious release was available for roughly eight hours, revoked the compromised publishing token, shifted npm publishing to **OIDC provenance via GitHub Actions**, and urged users who installed the affected version to upgrade to `2.4.0` or later and inspect their environments. Reporting cited roughly 4,000 downloads before the package was deprecated, with Microsoft also observing increased OpenClaw installations linked to the Cline installer. Separately, GitHub disclosed **CVE-2026-44211**, a `9.7`-severity cross-origin WebSocket hijacking flaw in the `kanban` npm package used by Cline. The issue stems from a local server on `127.0.0.1:3484` accepting unauthenticated cross-origin WebSocket connections without validating the `Origin` header, exposing endpoints including `/api/runtime/ws`, `/api/terminal/io`, and `/api/terminal/control`. A developer who visits a malicious website while Cline is running can have workspace paths, task data, git details, and AI chat messages exfiltrated; attackers can also inject prompts into active agent terminals to achieve arbitrary code execution or terminate sessions for denial of service on macOS, Linux, and Windows. At the time of disclosure, recommended mitigations included adding Origin validation, randomized session tokens, and authentication for terminal WebSocket access.
Jun 29, 2026
Tilt patched a high-severity flaw tracked as **CVE-2026-55883** that allowed cross-site WebSocket hijacking of the local HUD server, exposing the `/ws/view` stream to reachable attackers when the interface was bound beyond localhost. Affected versions **0.24.0 through 0.37.3** could leak session state, `Tiltfile` contents, resource status, and live updates because the WebSocket relied on a CSRF token obtainable from the unauthenticated `/api/websocket_token` endpoint, and the upgrader accepted clients without an `Origin` header. The issue is rated **CVSS 8.3** and is fixed in **Tilt 0.37.4**. The remediation hardens Tilt's HTTP/HUD server beyond the WebSocket path by adding token-based authentication to sensitive and mutating API routes, validating `Origin` headers to block cross-origin abuse, setting the session cookie to **`SameSite=Strict`**, and applying the same token checks to proxy endpoints. Tilt also restricted `/debug/pprof`-style debug endpoints to loopback clients and updated CLI behavior to send the Tilt token in an `X-Tilt-Token` header, while warning that exposing the HUD on non-local interfaces has security implications. Users are advised to upgrade to **0.37.4**, keep the HUD off the network where possible, and limit access if remote exposure is required.
Jul 11, 2026
A **critical vulnerability in the OpenClaw AI Assistant** (aka *Clawdbot*) allows a malicious website opened in the same browser session to connect to a locally exposed relay service and abuse the **Chrome DevTools Protocol (CDP)** to hijack browser sessions and steal credentials. Reporting indicates the extension starts a local server on `127.0.0.1:17892` and exposes WebSocket endpoints including `/cdp`; due to insufficient origin validation, attacker-controlled JavaScript can connect to `ws://127.0.0.1:17892/cdp`, enumerate tabs, and issue CDP commands (e.g., `Runtime.evaluate`) to extract cookies/session tokens or execute script in other tabs, impacting high-value services such as **Gmail** and **Microsoft 365**. Proof-of-concept code is publicly available and exploitation has been demonstrated, making the attack low-effort and high-impact for affected users. The issue has reportedly been **patched in the latest OpenClaw release**, and organizations using the extension should update immediately and assess exposure for potential session-token theft. Separate from OpenClaw, Plone CMS maintainers reported stopping a **supply-chain attempt** after an attacker used a stolen GitHub personal access token to force-push whitespace-obfuscated malicious code into multiple repositories; the changes were detected before any official release and were assessed as targeting developers rather than Plone site visitors.
Jun 29, 2026