CVE-2026-44211

Published: Jun 1, 2026Modified: Jul 22, 2026

9.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.

Affected (1)

Products: Cline: Cline

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cline Cline	Up to 2.13.0

Related CWEs

Missing Origin Validation in WebSockets

The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://github.com/cline/cline/security/advisories/GHSA-5c57-rqjx-35g2

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

https://github.com/cline/cline/security/advisories/GHSA-5c57-rqjx-35g2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationVendor Advisory

Timeline

No history available yet.