Arbitrary code execution in Cline

Cline (formerly Claude Dev) is one of the most popular extensions for AI-assisted programming in VS Code, with around 4.2 million installs.

Manifold Security discovered two vulnerabilities in Cline that allow arbitrary command execution on a developer's machine.

An attacker can inject commands through repository content or a README file when the AI agent automatically installs a project. In both cases, the code runs with the user's privileges and can potentially expose SSH keys, cloud credentials, cookies, and source code. The affected features are openUrlInBrowser and the Safe Commands filter in Cline version 3.81.0.

The first bug is in openUrlInBrowser: when the handler checks a link for previewing a data source URL used by the agent, it passes the URL string directly to child_process.exec, allowing arbitrary command injection, such as ; open ‑a Calculator;, to run before the confirmation dialog appears. The