CVE-2026-30313

DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on string-based parsing to validate commands; while it intercepts dangerous operators such as ;, &&, ||, |, and command substitution patterns, it fails to account for raw newline characters embedded within the input. An attacker can construct a payload by embedding a literal newline between a whitelisted command and malicious code (e.g., git log malicious_command), forcing DSAI-Cline to misidentify it as a safe operation and automatically approve it. The underlying PowerShell interpreter treats the newline as a command separator, executing both commands sequentially, resulting in Remote Code Execution without any user interaction.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/9	Third Party Advisory
https://github.com/necboy/cline-DSAI	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:cline:cline:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-30 21:17

Updated : 2026-06-17 10:32

NVD link : CVE-2026-30313

Mitre link : CVE-2026-30313

CVE.ORG link : CVE-2026-30313

JSON object : View

Products Affected

cline

cline

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-30313", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30313", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T18:01:59.801092Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-30T21:17:09.230", "references": [{"url": "https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/9", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/necboy/cline-DSAI", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on string-based parsing to validate commands; while it intercepts dangerous operators such as ;, &&, ||, |, and command substitution patterns, it fails to account for raw newline characters embedded within the input. An attacker can construct a payload by embedding a literal newline between a whitelisted command and malicious code (e.g., git log malicious_command), forcing DSAI-Cline to misidentify it as a safe operation and automatically approve it. The underlying PowerShell interpreter treats the newline as a command separator, executing both commands sequentially, resulting in Remote Code Execution without any user interaction."}, {"lang": "es", "value": "El m\u00f3dulo de autoaprobaci\u00f3n de comandos de DSAI-Cline contiene una vulnerabilidad cr\u00edtica de inyecci\u00f3n de comandos del sistema operativo que hace que su mecanismo de seguridad de lista blanca sea completamente ineficaz. El sistema se basa en el an\u00e1lisis de cadenas para validar comandos; si bien intercepta operadores peligrosos como ;, &&, ||, | y patrones de sustituci\u00f3n de comandos, no tiene en cuenta los caracteres de nueva l\u00ednea sin procesar incrustados en la entrada. Un atacante puede construir una carga \u00fatil incrustando una nueva l\u00ednea literal entre un comando de lista blanca y c\u00f3digo malicioso (por ejemplo, git log malicious_command), lo que obliga a DSAI-Cline a identificarlo err\u00f3neamente como una operaci\u00f3n segura y aprobarlo autom\u00e1ticamente. El int\u00e9rprete de PowerShell subyacente trata la nueva l\u00ednea como un separador de comandos, ejecutando ambos comandos secuencialmente, lo que resulta en ejecuci\u00f3n remota de c\u00f3digo sin ninguna interacci\u00f3n del usuario."}], "lastModified": "2026-06-17T10:32:38.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cline:cline:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F2D265D-27A6-4037-B0AC-C85E27D00E31", "versionEndIncluding": "1.1.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}