CVE-2026-44211
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Cline is an autonomous coding agent available as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At the time of publication, no public patches are available.
Risk Assessment
An attacker can hijack a WebSocket session, potentially leading to unauthorized data access or code execution in the victim's context.
Recommendation
It is recommended to immediately update Cline to the latest available version if a patch is available, or apply temporary mitigations such as blocking unauthorized WebSocket connections.
Original NVD description (English source)
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.