4.0.1785456841

Cline (Nightly)

Name: Cline (Nightly)
Author: saoudrizwan

Autonomous coding agent right in your IDE, capable of creating/editing files, running commands, using the browser, and more with your permission every step of the way.

AI Chat Programming Languages Education Snippets Testing

Rank#-4595

saoudrizwanopenvsx162,352Sep 14, 2026, 03:59 PMRegistryHomepageGitHub

Created: 2 years ago
Last commit: 6 days ago
Latest release: desktop-v0.0.377 days ago

Security Findings

Credential harvesting

MaliciousScanner

Hardcoded secret + sensitive file access

OWASP-AST01 OWASP-AST03

pull_request_target with secrets

MaliciousLineage

[.github/workflows/ext-jb-test-integration.yml] pull_request_target with secrets

Suspicious URL TLD2×

Scanner

URL with suspicious TLD .xyz: https://api.ambient.xyz/v1

URL with suspicious TLD .xyz: https://api.together.xyz/v1

OWASP-AST02

Dynamic exec of remote content (VSX)

Scanner

Fetched content reaches a dynamic exec sink in next/dist/extension.js: Axios

next/dist/extension.js

OWASP-AST06

Dynamic exec of remote content (VSX)

Scanner

Download-and-execute in legacy/webview-ui/build/assets/index.js: chmod +x

legacy/webview-ui/build/assets/index.js

OWASP-AST06

Dynamic exec of remote content (VSX)

Scanner

Download-and-execute in next/webview-ui/build/assets/index.js: chmod +x

next/webview-ui/build/assets/index.js

OWASP-AST06

Hardcoded secrets/API keys10×

Scanner

Secret Keyword: ApiKe...****

Secret Keyword: usern...****

Secret Keyword: funct...****

Private Key: BEGIN...****

Secret Keyword: ****

Secret Keyword: strin...****

Secret Keyword: https...****

Secret Keyword: API_K...****

Secret Keyword: AWS_S...****

Secret Keyword: My AP...****

legacy/dist/extension.js

OWASP-AST04

Hardcoded secrets/API keys

Scanner

Secret Keyword: phc_k...****

legacy/webview-ui/build/assets/index.js

OWASP-AST04

Hardcoded secrets/API keys5×

Scanner

Secret Keyword: strin...****

Private Key: BEGIN...****

Secret Keyword: funct...****

Secret Keyword: https...****

Secret Keyword: phc_k...****

next/dist/extension.js

OWASP-AST04

Hardcoded secrets/API keys

Scanner

Secret Keyword: phc_k...****

next/webview-ui/build/assets/index.js

OWASP-AST04

Sensitive file access3×

Scanner

Access to sensitive file: ~/.ssh

Access to sensitive file: ~/.aws

Access to sensitive file: homedir(),".cline","endpoints.json")}static getBundledEndpointsFilePath(){return uVr.join(t._extensionFsPath,"endpoints....

OWASP-AST03

Dangerous security bypass flags3×

Scanner

Bypass flag in command: hasColor = `+i);return Error.captureStackTrace.call(a,t),a.platform=e,a.hasUnicode=r,a.hasColor=i,a.code="EMISSINGTHEME"...

Bypass flag in content: --trust

Bypass flag in command: `),!1,d),typeof f=="string"&&f.length>0&&t.emitter.emitReasoningDelta(f,!1,d)}return}let s=Geo(o);if(!s)return;let u=typ...

OWASP-AST06

Workflow makes outbound network call

Lineage

[.github/workflows/ext-vscode-ab-package.yml] curl -sf --retry 3 -X POST "https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery