jebmcp

A quick-and-dirty MCP server&Plugin for JEB Pro. Tested on Cline & Cursor & RooCode. Reference: https://github.com/mrexodia/ida-pro-mcp Installation Requirements Python = 3.11 uv: https://docs.astral.sh/uv/getting-started/installation/ Usage COPY the src/jebmcp/MCP.py to...

Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents

Coding agents that run long enough must compact their context, summarizing the conversation, discarding the original, and carrying the summary forward as memory. We show that in popular open-source coding agents this step is an exploitable trust boundary. Harnesses that flatten the typed...

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

Summary The Cline Hub dashboard server @cline/cline-hub, launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOMSECRET is not set—the default for local 127.0.0.1 binds—isAuthorizedBrowserRequest...

@axelspringer/hubots (>=1.0.0, <=1.0.11), @flambo/bot (>=0.1.0, <=0.1.2) +188 more potentially affected by CVE-2026-59723 via cline (>=0.8.2, <=3.0.73)

cline NPM version =0.8.2, =1.0.0, =0.1.0, =0.0.2-alpha.0, =0.0.1, =0.1.0, =0.0.0, =0.0.16, =4.0.0-alpha.2, =0.3.0, =2.0.0 and more Source cves: CVE-2026-59723 Source advisory: SNYK:JS-CLINE-20158397...

NPM: Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

NPM: Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard /browser endpoint vulnerability discovered by ? in WordPress Npm cline versions 3.0.30...

GHSA-3CJ3-HQCR-G934 Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

Summary The Cline Hub dashboard server @cline/cline-hub, launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOMSECRET is not set—the default for local 127.0.0.1 binds—isAuthorizedBrowserRequest...

Origin Validation Error

Overview cline is an Autonomous coding agent CLI - capable of creating/editing files, running commands, using the browser, and more Affected versions of this package are vulnerable to Origin Validation Error via missing WebSocket host and origin validation in the cline-hub dashboard server...

EUVD-2026-42475

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard /browser endpoint...

CVE-2026-59723

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOMSECRET is unset for loc...

CVE-2026-59723 Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOMSECRET is unset for loc...

CVE-2026-59723 Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOMSECRET is unset for loc...

@axelspringer/hubots (>=1.0.0, <=1.0.11), @flambo/bot (>=0.1.0, <=0.1.2) +186 more potentially affected by CVE-2026-59723 via cline (>=0.8.2, <=2.18.0)

cline NPM version =0.8.2, =1.0.0, =0.1.0, =0.0.2-alpha.0, =0.0.1, =0.1.0, =0.0.0, =0.0.16, =4.0.0-alpha.2, =0.3.0, =2.0.0 and more Source cves: CVE-2026-59723 Source advisory: MEND:CVE-2026-59723...

CVE-2026-59723

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOMSECRET is unset for loc...

CVE-2026-59723

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOMSECRET is unset for loc...

PT-2026-56625

Name of the Vulnerable Software and Affected Versions Cline versions prior to 3.0.30 Description The Cline Hub dashboard server, initiated via the cline dashboard command, fails to validate the Origin header for WebSocket connections on the /browser endpoint. When the ROOM SECRET is unset for loc...

CVE-2026-59723: Origin Validation Error

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOMSECRET is unset for loc...

CVE-2026-44211

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches...

CVE-2026-44211

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches...

CVE-2026-44211

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches...

CVE-2026-44211 Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches...