Vulnerability in Cline
CVE-2026-59723
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOM_SECRET is unset for local 127.0.0.1 binds, isAuthorizedBrowserRequest() allows attacker-controlled websites to send desktopCommand frames that read workspace state, mutate MCP and provider settings, and trigger command execution when a provider or model is configured. This issue is fixed in version 3.0.30.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (14.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 14.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Cline — versions < 3.0.30
Weakness classification (CWE)
References
- github.com/cline/cline/security/advisories/GHSA-3cj3-hqcr-g934 (Exploit, Vendor Advisory)
- github.com/cline/cline/pull/11724 (Patch, Issue Tracking)
- github.com/cline/cline/commit/d09270940f5746f288cfc4a5039b46a2f4d5d01e (Patch)
- github.com/cline/cline/releases/tag/cli-v3.0.30 (Release Notes)
Frequently asked questions
- What is CVE-2026-59723?
- CVE-2026-59723 is a high-severity vulnerability in Cline, classified under Origin Validation Error. CVSS score: 8.8/10. Published 2026-07-08.
- How severe is CVE-2026-59723?
- High severity. CVSS v3 base score is 8.8 out of 10.