DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-59723: CVE-2026-59723: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard Server

#security #cve #cybersecurity

CVE-2026-59723: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard Server

Vulnerability ID: CVE-2026-59723
CVSS Score: 8.8
Published: 2026-09-24

A critical Cross-Origin WebSocket Hijacking (CSWSH) vulnerability exists in the Cline Hub dashboard server (@cline/cline-hub) prior to version 3.0.30. By exploiting a complete lack of Origin header validation and an insecure default configuration where ROOM_SECRET is unset, an attacker can hijack the local WebSocket connection via a malicious website. This enables unauthorized arbitrary command execution through desktopCommand frames, leading to remote code execution on the host machine.

TL;DR

Unauthenticated Cross-Origin WebSocket Hijacking in local @cline/cline-hub servers allows remote websites to execute arbitrary system commands on a developer's workstation via crafted WebSocket frames.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-346
  • Attack Vector: Adjacent (delivered via browser client)
  • CVSS Score: 8.8
  • EPSS Score: 0.00249
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • @cline/cline-hub
  • cline
  • Cline Hub Dashboard Server
  • @cline/cline-hub: < 3.0.30 (Fixed in: 3.0.30)

Code Analysis

Commit: d092709

Strict route and WebSocket upgrade validation to prevent Cross-Origin WebSocket Hijacking

Mitigation Strategies

  • Upgrade @cline/cline-hub to 3.0.30 or newer
  • Set a high-entropy ROOM_SECRET environment variable
  • Restrict localhost port access using firewall configurations

Remediation Steps:

  1. Verify currently installed version of cline using cline --version
  2. Run npm update -g @cline/cline-hub or the equivalent package manager command to upgrade to version 3.0.30 or higher
  3. Configure the ROOM_SECRET environment variable to secure local setups
  4. Re-launch the dashboard with the updated package

References

Read the full report for CVE-2026-59723 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)