{"uuid": "0397e0ca-1dde-4607-99f5-b5a0892b07e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59723", "type": "seen", "source": "https://gist.github.com/alon710/7d70058d99e8d7099d62683f8d252c62", "content": "# CVE-2026-59723: CVE-2026-59723: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard Server\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59723\n\n## Summary\nA critical Cross-Origin WebSocket Hijacking (CSWSH) vulnerability exists in the Cline Hub dashboard server (@cline/cline-hub) prior to version 3.0.30. By exploiting a complete lack of Origin header validation and an insecure default configuration where ROOM_SECRET is unset, an attacker can hijack the local WebSocket connection via a malicious website. This enables unauthorized arbitrary command execution through desktopCommand frames, leading to remote code execution on the host machine.\n\n## TL;DR\nUnauthenticated Cross-Origin WebSocket Hijacking in local `@cline/cline-hub` servers allows remote websites to execute arbitrary system commands on a developer's workstation via crafted WebSocket frames.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-346\n- **Attack Vector**: Adjacent (delivered via browser client)\n- **CVSS Score**: 8.8\n- **EPSS Score**: 0.00249\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @cline/cline-hub\n- cline\n- Cline Hub Dashboard Server\n- **@cline/cline-hub**: < 3.0.30 (Fixed in: `3.0.30`)\n\n## Mitigation\n\n- Upgrade @cline/cline-hub to 3.0.30 or newer\n- Set a high-entropy ROOM_SECRET environment variable\n- Restrict localhost port access using firewall configurations\n\n**Remediation Steps:**\n1. Verify currently installed version of cline using `cline --version`\n2. Run `npm update -g @cline/cline-hub` or the equivalent package manager command to upgrade to version 3.0.30 or higher\n3. Configure the ROOM_SECRET environment variable to secure local setups\n4. Re-launch the dashboard with the updated package\n\n## References\n\n- [GHSA-3cj3-hqcr-g934: Cross-Origin WebSocket Hijacking in @cline/cline-hub](https://github.com/cline/cline/security/advisories/GHSA-3cj3-hqcr-g934)\n- [GitHub Pull Request #11724](https://github.com/cline/cline/pull/11724)\n- [GitHub Commit d09270940f5746f288cfc4a5039b46a2f4d5d01e](https://github.com/cline/cline/commit/d09270940f5746f288cfc4a5039b46a2f4d5d01e)\n- [Official Patch Diff File](https://github.com/cline/cline/commit/d09270940f5746f288cfc4a5039b46a2f4d5d01e.patch)\n- [Cline v3.0.30 Release Notes](https://github.com/cline/cline/releases/tag/cli-v3.0.30)\n- [National Vulnerability Database Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-59723)\n- [MITRE CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-59723)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59723) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T05:30:32.000000Z"}