Cline: A Prompt Injection Exposes Its Releases

A Sneaky Attack via GitHub

Adnan Khan has highlighted a clever attack method against Cline's GitHub repository, exploiting a vulnerability in automated issue triage. The attack begins with a prompt injection in the title of an open issue, targeting the action anthropics/claude-code-action@v1 used by Cline to manage issues.

This action was configured to execute Claude Code with authorized tools like "Bash, Read, Write, ..." every time an issue was opened. The prompt included the issue title, allowing an attacker to manipulate Claude into executing arbitrary commands.

Exploiting Workflows and Caches

The attack exploited an issue title designed to prompt the execution of malicious commands, such as installing a package via npm install. This package could then execute malicious code through a "preinstall" script in its package.json file.

Although the issue triage workflow did not have access to critical secrets, a flaw in GitHub's cache management was exploited. Caches exceeding 10 GB are evicted, and the attacker used the package cacheract to fill existing caches with 11 GB of useless data, evicting them and creating new caches containing a secret theft mechanism.

Cache Contamination and Unauthorized Release

GitHub Actions caches can share identical names across different workflows. In Cline's case, the issue triage and nightly publication workflows shared the same cache key for their node_modules folder. This allowed a successful prompt injection to contaminate the cache, which was then used by the nightly publication workflow.

Cline failed to promptly address the responsibly disclosed bug report and was exploited. This vulnerability led to the unauthorized release of cline@2.3.0 by an anonymous attacker. Fortunately, the attacker limited themselves to adding the installation of OpenClaw to the package, without taking more dangerous actions.