# Cline: Vulnerable To Data Exfiltration And How To Protect Your Data

Cline AI coding agent renders markdown images from untrusted domains, letting a prompt injection read .env secrets and exfiltrate them via image URL.

- Payout: Research
- Severity: high
- Program: Cline
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-27
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2025/cline-vulnerable-to-data-exfiltration/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cline-vulnerable-to-data-exfiltration
- Tags: area:ai domain:ai impact:data-leak kind:research platform:research sev:high tech:llm technique:chained vuln:info-disclosure vuln:prompt-injection

**Target:** AI coding agent chat markdown renderer
**Root cause:** Cline auto-renders markdown images from arbitrary untrusted domains in the chat box without confirmation, so attacker-controlled content can embed a URL containing stolen data.
**Steps:**
1. Create `demo.md` containing a prompt injection instructing Cline to read `.env` and append its contents to an image URL (core payload redacted).
2. Create a `.env` file with a dummy secret.
3. Ask Cline to explain the contents of `demo.md`.
4. Cline follows the injection, reads `.env`, and renders the image, sending the secret to the attacker's domain.
**How found:** Author noted similarity to a prior Microsoft Copilot Chat data exfiltration bug and tested whether Cline's chat renderer loads markdown images from untrusted domains, confirming via prompt injection PoC.
**Exploitation:** Attacker plants injected instructions in a file, website, or MCP server content. When the victim asks Cline to analyze it, the agent reads sensitive local files (e.g. .env) and embeds their contents in a markdown image URL that the chat auto-loads, exfiltrating data without human approval.
**Escalation:** Same technique works from other untrusted sources like website content and MCP servers, broadening the attack surface.
**Insight:** AI agent chat UIs that auto-render markdown images are exfiltration sinks: any prompt injection that can read local files can smuggle them out via image URLs, so test image/link rendering as a covert channel.