The Cline Hub dashboard server, when started by the cline dashboard command, exposes a WebSocket endpoint for the /browser path without requiring an Origin header. This is a CWE‑346 flaw, representing a missing Origin header check that allows unrestricted browser connections. When the local ROOM_SECRET variable is unset, the isAuthorizedBrowserRequest() logic accepts any connection from an attacker‑controlled website. An attacker can therefore send desktopCommand frames that read the workspace state, modify model‑provider settings, and trigger command execution if a provider or model is configured. The flaw allows an attacker to achieve remote code execution on the host running the dashboard, which is a serious breach of confidentiality, integrity, and availability.

This vulnerability affects the Cline Hub dashboard server, part of the cline:cline product. All releases before version 3.0.30 are vulnerable. Users running the dashboard on a local 127.0.0.1 binding are impacted unless the ROOM_SECRET environment variable is set. No explicit version list is provided beyond the note that version 3.0.30 contains the fix.

The CVSS score is 8.8, indicating a high severity. The EPSS score is < 1%, indicating a very low exploitation probability. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker‑hosted web page that the victim opens while the Cline dashboard is running locally; the page then initiates a WebSocket connection to http://127.0.0.1:port/browser, exploiting the missing Origin check to send malicious frames. This scenario requires the user to be running the vulnerable dashboard, the device to bind locally, and the attacker to control a web page accessible to the user. The impact is therefore significant if these conditions are met.