{
  "entry": {
    "kind": "vuln",
    "slug": "clinejection-cline-v2-3-0-supply-chain-attack-via-github-issue-bot",
    "name": "clinejection-cline-v2-3-0-supply-chain-attack-via-github-issue-bot",
    "vendor": "Cline",
    "description": "An attacker injected a malicious instruction into a GitHub issue title, which Cline's AI-powered triage bot interpreted as a real command and executed, leaking the project's npm publish token. The attacker used that token to publish cline@2.3.0, which silently installed OpenClaw on developer machines; approximately 4,000 developers downloaded the backdoored version in an 8-hour window before it was deprecated.",
    "website": "https://thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-02-20",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "clinejection-cline-v2-3-0-supply-chain-attack-via-github-issue-bot",
      "aliases": [
        "ti-004"
      ],
      "title": "\"Clinejection\": Cline v2.3.0 Supply Chain Attack via GitHub Issue Bot Prompt Injection",
      "summary": "An attacker injected a malicious instruction into a GitHub issue title, which Cline's AI-powered triage bot interpreted as a real command and executed, leaking the project's npm publish token. The attacker used that token to publish cline@2.3.0, which silently installed OpenClaw on developer machines; approximately 4,000 developers downloaded the backdoored version in an 8-hour window before it was deprecated.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Supply chain compromise"
      ],
      "componentType": "agent",
      "component": {
        "name": "Cline",
        "vendor": null,
        "package": null,
        "ecosystem": "npm",
        "catalogSlug": "agent/cline"
      },
      "affected": [
        {
          "range": "Cline 2.3.0 (backdoored release)",
          "fixed": "2.3.1"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-02-20",
      "modifiedAt": "2026-02-20",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html"
        }
      ],
      "mitigation": "Ensure Cline is not on v2.3.0; upgrade to 2.3.1+ or downgrade to 2.2.x. Scan machines for OpenClaw installed via this vector. Review npm lockfiles for unexpected cline version changes.",
      "detectedByAnomity": true
    }
  }
}