Cline Hub Dashboard: Cross-Origin WebSocket Hijacking Allows Local Code Execution (CVE-2026-59723)

What happened

A security advisory describes a Cross-Origin WebSocket Hijacking vulnerability in the Cline Hub dashboard server's `/browser` WebSocket endpoint. When the dashboard is started with its default local configuration (bound to 127.0.0.1) and no `ROOM_SECRET` environment variable is set, the server's authorization check unconditionally allows connections, and the server does not validate the HTTP Origin header on WebSocket upgrade requests. As a result, JavaScript running on any website a developer happens to visit can open a WebSocket connection to the local dashboard and send commands to it.

Technical cause

According to the advisory, the dashboard's `normalizeRoomSecret()` function converts an unset or empty `ROOM_SECRET` environment variable to `undefined`, and the local default host (127.0.0.1) is permitted to start without a secret. The function `isAuthorizedBrowserRequest()` then returns `true` unconditionally whenever `roomSecret` is `undefined`, and no Origin header check is performed anywhere in the WebSocket upgrade path for the `/browser` endpoint. Browsers include the Origin header on WebSocket connections but leave enforcement to the server; since the server does not inspect it, any cross-origin page can connect. Additionally, dashboard sessions are created with a default tool policy of `autoApprove: true` for all tools, and an `upsert_mcp_server` command handler writes attacker-supplied MCP server configuration entries (including arbitrary `stdio` command/argument pairs) directly to the Cline settings file without further authorization checks.

Why it matters

Because the dashboard binds to a local port and skips Origin validation by default, an attacker does not need network access to the victim's machine — a single visit to a malicious or compromised web page while the dashboard is running is enough to trigger the issue. The advisory describes a confirmed proof of concept in which a cross-origin page injects a malicious `stdio` MCP server entry into the victim's Cline settings file, which executes a shell command the next time Cline activates that MCP server. Because dashboard-created sessions auto-approve all tools by default, an attacker who can reach an active session with a configured AI provider could also potentially direct the agent to perform file operations, run commands, or access credentials available in the developer's environment, without any confirmation prompt being shown.

Who is affected

Developers who run the `cline dashboard` command from the `cline` npm package in its default local configuration (host 127.0.0.1, no `ROOM_SECRET` set) are affected. The advisory's proof of concept was demonstrated against `cline` version 3.0.24. The affected range covers versions of `cline` starting from version 0 up to, but not including, the fixed version 3.0.30.

Affected versions

Versions of `cline` from 0 up to (but not including) 3.0.30 are affected, per the advisory's affected-range data.

Fixes and mitigation

The advisory lists 3.0.30 as the fixed version of `cline`. Organizations and developers running the Cline Hub dashboard should upgrade to this fixed version. No further mitigation steps beyond upgrading are described in the available facts.

Recommended action

Developers using `cline dashboard` should upgrade `cline` to version 3.0.30 as soon as practical. Until upgraded, avoid running the dashboard while browsing untrusted websites, since any open browser tab could interact with an active dashboard session on the default local configuration.