"Clinejection": Cline v2.3.0 Supply Chain Attack via GitHub Issue Bot Prompt Injection
"Clinejection": Cline v2.3.0 Supply Chain Attack via GitHub Issue Bot Prompt Injection is a critical-severity prompt injection issue in Cline, an AI agent. Affected: Cline 2.3.0 (backdoored release). Fixed in 2.3.1.
Is Cline running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
clinejection-cline-v2-3-0-supply-chain-attack-via-github-issue-bot- Severity
- critical
- Attack type
- Prompt injection, Supply chain compromise
- Component
- Cline · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
An attacker injected a malicious instruction into a GitHub issue title, which Cline's AI-powered triage bot interpreted as a real command and executed, leaking the project's npm publish token. The attacker used that token to publish cline@2.3.0, which silently installed OpenClaw on developer machines; approximately 4,000 developers downloaded the backdoored version in an 8-hour window before it was deprecated.
Affected versions
| Affected | Fixed in |
|---|---|
Cline 2.3.0 (backdoored release) | 2.3.1 |
Am I affected by this vulnerability?
You are affected if you run Cline 2.3.0 (backdoored release). Versions 2.3.1 and later include the fix.
How do I fix it?
Ensure Cline is not on v2.3.0; upgrade to 2.3.1+ or downgrade to 2.2.x. Scan machines for OpenClaw installed via this vector. Review npm lockfiles for unexpected cline version changes.
How do I find every machine running Cline?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Cline and which version, then enforce a policy on it.