cline@3.0.60-nightly.1787845717

cline is an Autonomous coding agent CLI - capable of creating/editing files, running commands, using the browser, and more

Affected versions of this package are vulnerable to Origin Validation Error via missing WebSocket host and origin validation in the cline-hub dashboard server (apps/cline-hub/src/server.ts). An attacker on the same network can connect a malicious browser page to the dashboard WebSocket endpoint without presenting a valid origin or host header, because the server does not validate the Origin or Host of incoming WebSocket upgrade requests before the fix. This allows a cross-site WebSocket hijacking attack where a victim's browser, navigated to an attacker-controlled page, establishes a WebSocket connection to the local dashboard and relays commands, achieving full confidentiality, integrity, and availability impact over the desktop agent.

Note: This is only exploitable in the default configuration where roomSecret is undefined (no secret is set), which is the case when the server binds to the default local host 127.0.0.1.

A fix was pushed into the master branch but not yet published.