VulertSecurity VulertSecurity

Vulnerability Database · npm · Package report

cline: vulnerability history, versions and safety

cline is a package in the npm ecosystem. Vulert records 4 vulnerabilities for it across 120 releases, from Feb 2026 to Sep 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
4 vulnerabilities recorded C2 H1 L1
i
2 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
4 in the last 12 months

Most recent disclosure 24 Sep 2026.

See the disclosure history →
i
1 malicious-package vulnerabilities

A published version contained malicious code.

See malicious packages in npm →

See all cline vulnerabilities

Vulert verdict on cline 3.0.73 i

Updated on 23 Oct 2026

Careful: 3.0.73 was published with malicious code in it, not just a bug. Do not install it.

Package health score 15/100
  • Security Malicious code published
  • Maintenance Sustainable
  • Popularity Widely used
  • Community Active

The current release contains malicious code, which caps this score.

What to do: Do not resolve 3.0.73 as-is. Check whether you already run an affected release and pin a version the maintainers have re-published. Check what you run: Vulert alerts you when a safe version is published. Monitor it with Vulert →

  • Current release 3.0.73 — affected i
  • Vulnerabilities on record 4 over 1 year · 4 in the last year i
  • Latest disclosure 24 Sep 2026 i
  • Highest CVSS 9.6 i
  • With no published fix 2 i
  • Malicious packages 1 i
  • Depended on by 2 packages i
  • Stars 70,805 i
  • Last release this month i
  • Licence Apache-2.0 i
  • Similar names clone i

Version list, release dates, licence and dependants published by the npm registry, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for cline, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
3.0.73-nightly.1792632285 22 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.73-nightly.1792585325 21 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.73-nightly.1792498844 20 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.73-nightly.1792412563 19 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.73-nightly.1792239493 17 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.73 17 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.72-nightly.1792153337 16 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.72 16 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.71-nightly.1792066955 15 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.71-nightly.1791980503 14 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.71-nightly.1791894302 13 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.71 13 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.70-nightly.1791808209 12 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.70-nightly.1791721369 11 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.70-nightly.1791634794 10 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.70-nightly.1791548447 09 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.70-nightly.1791462196 08 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.70 08 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.69-nightly.1791375801 07 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.69 07 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.68-nightly.1791289325 06 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.68-nightly.1791203051 05 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.68-nightly.1791035349 03 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.68-nightly.1790943830 02 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.68 02 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.67-nightly.1790890217 01 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.67-nightly.1790857421 01 Oct 2026 C2 malicious Apache-2.0 No Details →
3.0.67 30 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.66-nightly.1790771151 30 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.66 30 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.65-nightly.1790684617 29 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.65-nightly.1790660207 29 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.65-nightly.1790598323 28 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.65-nightly.1790511650 27 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.65-nightly.1790425208 26 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.65-nightly.1790338973 25 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.65-nightly.1790252460 24 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.65 24 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.64-nightly.1790166135 23 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.64-nightly.1790079695 22 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.64 22 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.63 22 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.62-nightly.1789993298 21 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.62-nightly.1789906789 20 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.62-nightly.1789820351 19 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.62-nightly.1789733988 18 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.62-nightly.1789647736 17 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.62-nightly.1789561244 16 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.62-nightly.1789474877 15 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.62 15 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.61-nightly.1789388547 14 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.61-nightly.1789215570 12 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.61-nightly.1789129344 11 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.61-nightly.1789042889 10 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.61-nightly.1788956466 09 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.61-nightly.1788870110 08 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.61-nightly.1788783728 07 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.61-nightly.1788610676 05 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.61-nightly.1788524508 04 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.61-nightly.1788438179 03 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.61-nightly.1788351760 02 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.61 02 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.60-nightly.1788265276 01 Sep 2026 C2 malicious Apache-2.0 No Details →
3.0.60-nightly.1788092382 30 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.60-nightly.1788005944 29 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.60-nightly.1787933739 28 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.60-nightly.1787845717 27 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.60-nightly.1787786338 26 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.60-nightly.1787746479 26 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.60 26 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.58-nightly.1787660092 25 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.58 24 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.57-nightly.1787573657 24 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.57-nightly.1787487046 23 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.57 23 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.56-nightly.1787400630 22 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.56-nightly.1787314405 21 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.56 21 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.55-nightly.1787228028 20 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.55-nightly.1787141588 19 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.55-nightly.1787119313 19 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.55-nightly.1787055197 18 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.55-nightly.1786710171 14 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.55 14 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.54-nightly.1786623790 13 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.54 13 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.53-nightly.1786537371 12 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.53 11 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.52-nightly.1786450901 11 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.52-nightly.1786364546 10 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.52-nightly.1786277652 09 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.52 09 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.51-nightly.1786191203 08 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.51-nightly.1786105306 07 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.51-nightly.1786020258 06 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.51 06 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.50-nightly.1785933782 05 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.50 05 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.49-nightly.1785847481 04 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.49-nightly.1785762514 03 Aug 2026 C2 malicious Apache-2.0 No Details →
3.0.49-nightly.1785673698 02 Aug 2026 C2 malicious — No Details →
3.0.49 02 Aug 2026 C2 malicious — No Details →
3.0.48-nightly.1785587259 01 Aug 2026 C2 malicious — No Details →
3.0.48-nightly.1785501857 31 Jul 2026 C2 malicious — No Details →
3.0.48 31 Jul 2026 C2 malicious — No Details →
3.0.47-nightly.1785415224 30 Jul 2026 C2 malicious — No Details →
3.0.47-nightly.1785329239 29 Jul 2026 C2 malicious — No Details →
3.0.47 28 Jul 2026 C2 malicious — No Details →
3.0.46-nightly.1785242607 28 Jul 2026 C2 malicious — No Details →
3.0.46-nightly.1785157776 27 Jul 2026 C2 malicious — No Details →
3.0.46-nightly.1785068998 26 Jul 2026 C2 malicious — No Details →
3.0.46-nightly.1784982335 25 Jul 2026 C2 malicious — No Details →
3.0.46-nightly.1784896623 24 Jul 2026 C2 malicious — No Details →
3.0.46-nightly.1784810380 23 Jul 2026 C2 malicious — No Details →
3.0.46-nightly.1784637499 21 Jul 2026 C2 malicious — No Details →
3.0.46-nightly.1784463840 19 Jul 2026 C2 malicious — No Details →
3.0.46 19 Jul 2026 C2 malicious — No Details →
3.0.45 19 Jul 2026 C2 malicious — No Details →
3.0.44-nightly.1784377439 18 Jul 2026 C2 malicious — No Details →
3.0.44-nightly.1784291545 17 Jul 2026 C2 malicious — No Details →

The newest 120 of 400 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2026 4

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 4 of the 4 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for cline

The 4 most severe of 4 vulnerabilities recorded for this package

Search all 4 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-44211: Cline Kanban Server Cross-Origin WebSocket Hijacking Vulnerability 9.6 critical No fix published 08 May 2026
CVE-2026-59723: Cline Hub Dashboard Cross-Origin WebSocket Hijacking Vulnerability 8.8 high 3.0.30 24 Sep 2026
Unauthorized npm Publish Vulnerability in Cline CLI: cline@2.3.0 N/A low 2.4.0 19 Feb 2026
Malicious Code Injection in Cline Package: npm Vulnerability Overview N/A critical No fix published 12 Mar 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About cline

Is cline safe to use?

Vulert records 4 vulnerabilities for cline in npm: 2 critical, 1 high, 0 medium and 1 low. 2 of them have no published fix yet, so those are the ones to avoid or mitigate. 1 are malicious-package vulnerabilities: the published package itself contained hostile code, not only a bug.

What is cline's Vulert package health score?

Vulert scores cline 15/100, which reads as critical. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release contains malicious code, which caps this score.

Is the latest version of cline affected?

Yes. 3.0.73, the version you would install today, has 2 known vulnerabilities, and 2 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does cline have?

4 vulnerabilities are recorded for cline in the npm ecosystem: 2 critical, 1 high, 0 medium and 1 low. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new cline vulnerabilities disclosed?

4 vulnerabilities were recorded for cline in the last 12 months, and the oldest entry in this database dates to 19 Feb 2026. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of cline are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

What does a malicious-package vulnerability mean?

It means the published package itself contained hostile code — a backdoor, a credential stealer or similar — rather than only a bug. Registries remove such packages once they are confirmed, so treat any application that resolved an affected version as compromised and rotate the credentials it could reach.

How do I monitor cline for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the cline version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.