HIGH 8.8 GitHub
CVE-2026-59723
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
### Summary
The Cline Hub dashboard server (`@cline/cline-hub`), launched via the `cline dashboard` CLI command, accepts WebSocket connections on the `/browser` endpoint without validating the HTTP `Origin` header. When `ROOM_SECRET` is not set—the default for local (`127.0.0.1`) binds—`isAuthorizedBrowserRequest()` returns `true` unconditionally, allowing any website a developer visits to open a cross-origin WebSocket to `ws://127.0.0.1:8787/browser`. An attacker-controlled page can then send
Affected Products
- npm/cline < 3.0.30
References
- https://github.com/advisories/GHSA-3cj3-hqcr-g934
- https://github.com/cline/cline/security/advisories/GHSA-3cj3-hqcr-g934
- https://nvd.nist.gov/vuln/detail/CVE-2026-59723
- https://github.com/cline/cline/pull/11724
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-09-24 via GitHub. Affected: npm/cline < 3.0.30.
vulnfeed aggregates 11711 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.