{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/cline-hub/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["cline-hub"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","remote-code-execution","websocket-hijacking"],"_cs_type":"advisory","_cs_vendors":["Cline"],"content_html":"\u003cp\u003eThe Cline Hub dashboard server ('@cline/cline-hub'), typically initiated via the \u003ccode\u003ecline dashboard\u003c/code\u003e CLI command, contains a critical security flaw involving Cross-Origin WebSocket Hijacking (CSWSH). In its default configuration, the dashboard binds to \u003ccode\u003e127.0.0.1\u003c/code\u003e without requiring a \u003ccode\u003eROOM_SECRET\u003c/code\u003e. Under these conditions, the server's \u003ccode\u003eisAuthorizedBrowserRequest()\u003c/code\u003e function returns \u003ccode\u003etrue\u003c/code\u003e for all requests and performs no validation of the HTTP \u003ccode\u003eOrigin\u003c/code\u003e header during the WebSocket upgrade process.\u003c/p\u003e\n\u003cp\u003eThis vulnerability allows any malicious website visited by a developer running the Cline dashboard to open a WebSocket connection to \u003ccode\u003ews://127.0.0.1:8787/browser\u003c/code\u003e. Once connected, the attacker can interact with the Cline session as if they were a legitimate user. This includes the ability to inject malicious MCP server configurations, modify tool approval policies, and command agent sessions to perform unauthorized actions such as file system manipulation or arbitrary command execution on the host machine. Because dashboard sessions default to auto-approving tools, this process requires no victim interaction beyond simply visiting a compromised page.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe victim starts \u003ccode\u003ecline dashboard\u003c/code\u003e locally, which defaults to \u003ccode\u003e127.0.0.1:8787\u003c/code\u003e without a \u003ccode\u003eROOM_SECRET\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker lures the victim to a malicious website containing a cross-origin WebSocket payload.\u003c/li\u003e\n\u003cli\u003eThe victim's browser initiates a WebSocket connection request to \u003ccode\u003ews://127.0.0.1:8787/browser\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Cline Hub dashboard server receives the request, identifies the missing secret, and unconditionally approves the connection, ignoring the \u003ccode\u003eOrigin\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eThe attacker's script sends a \u003ccode\u003edesktopCommand\u003c/code\u003e frame of type \u003ccode\u003eupsert_mcp_server\u003c/code\u003e over the established WebSocket.\u003c/li\u003e\n\u003cli\u003eThe server processes the frame and writes a malicious \u003ccode\u003estdio\u003c/code\u003e MCP server entry to \u003ccode\u003e$CLINE_DATA_DIR/settings/cline_mcp_settings.json\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpon the next invocation or activation of the MCP server by the Cline agent, the injected command is executed with the privileges of the victim's local user account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full command execution on the developer's local machine, potential exfiltration of sensitive session tokens or API keys, and persistent compromise via the injection of malicious MCP server entries into the developer's configuration files. This impacts any environment where developers use the default dashboard settings, posing a significant risk to individual workstations and the local development ecosystem.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eEnsure that the \u003ccode\u003eROOM_SECRET\u003c/code\u003e environment variable is always explicitly set for any instance of the Cline dashboard to enforce mandatory authentication.\u003c/li\u003e\n\u003cli\u003eImplement local firewall rules or browser security extensions to restrict WebSocket connections to \u003ccode\u003e127.0.0.1\u003c/code\u003e to authorized origins only.\u003c/li\u003e\n\u003cli\u003eRegularly audit \u003ccode\u003e$CLINE_DATA_DIR/settings/cline_mcp_settings.json\u003c/code\u003e for unexpected entries or suspicious \u003ccode\u003estdio\u003c/code\u003e commands.\u003c/li\u003e\n\u003cli\u003eAvoid running the \u003ccode\u003ecline dashboard\u003c/code\u003e in environments where untrusted browser activity is expected.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-24T20:04:43Z","date_published":"2026-09-24T20:04:43Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cline-cswsh/","summary":"The Cline Hub dashboard fails to validate Origin headers and bypasses authorization when no secret is configured, allowing malicious websites to hijack local WebSocket connections to execute arbitrary code.","title":"Cross-Origin WebSocket Hijacking in Cline Hub Dashboard","url":"https://feed.craftedsignal.io/briefs/2026-09-cline-cswsh/"}],"language":"en","title":"CraftedSignal Threat Feed - Cline-Hub","version":"https://jsonfeed.org/version/1.1"}