# clinejection-cline-v2-3-0-supply-chain-attack-via-github-issue-bot: "Clinejection": Cline v2.3.0 Supply Chain Attack via GitHub Issue Bot Prompt Injection

> "Clinejection": Cline v2.3.0 Supply Chain Attack via GitHub Issue Bot Prompt Injection is a critical-severity prompt injection issue in Cline, an AI agent. Affected: Cline 2.3.0 (backdoored release). Fixed in 2.3.1.

- **Canonical URL:** https://catalog.anomity.ai/vuln/clinejection-cline-v2-3-0-supply-chain-attack-via-github-issue-bot
- **Aliases:** ti-004
- **Severity:** critical
- **Attack type:** Prompt injection, Supply chain compromise
- **Component:** Cline (AI agent)
- **Catalog entry:** https://catalog.anomity.ai/agent/cline
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-02-20
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/clinejection-cline-v2-3-0-supply-chain-attack-via-github-issue-bot

## Summary

An attacker injected a malicious instruction into a GitHub issue title, which Cline's AI-powered triage bot interpreted as a real command and executed, leaking the project's npm publish token. The attacker used that token to publish cline@2.3.0, which silently installed OpenClaw on developer machines; approximately 4,000 developers downloaded the backdoored version in an 8-hour window before it was deprecated.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Cline 2.3.0 (backdoored release) | 2.3.1 |

## Am I affected by this vulnerability?

You are affected if you run Cline 2.3.0 (backdoored release). Versions 2.3.1 and later include the fix.

## How do I fix it?

Ensure Cline is not on v2.3.0; upgrade to 2.3.1+ or downgrade to 2.2.x. Scan machines for OpenClaw installed via this vector. Review npm lockfiles for unexpected cline version changes.

## How do I find every machine running Cline?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Cline and which version, then enforce a policy on it.

## References

- article: https://thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html

## Related vulnerabilities

- [hallusquatting-weaponizes-ai-package-hallucinations-for-malware-delivery](https://catalog.anomity.ai/vuln/hallusquatting-weaponizes-ai-package-hallucinations-for-malware-delivery) — high
- [trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant](https://catalog.anomity.ai/vuln/trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant) — critical
- [load-mine-31-fake-qwen2-repositories-on-hugging-face-and-modelscope](https://catalog.anomity.ai/vuln/load-mine-31-fake-qwen2-repositories-on-hugging-face-and-modelscope) — high
- [forever-security-an-agents-md-planted-in-downloads-got-codex-to](https://catalog.anomity.ai/vuln/forever-security-an-agents-md-planted-in-downloads-got-codex-to) — high
- [microsoft-china-aligned-storm-0940-ran-the-artex-agentic-pen-test](https://catalog.anomity.ai/vuln/microsoft-china-aligned-storm-0940-ran-the-artex-agentic-pen-test) — high
- [CVE-2026-96893](https://catalog.anomity.ai/vuln/cve-2026-96893) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=clinejection-cline-v2-3-0-supply-chain-attack-via-github-issue-bot