Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager

2026-02-20

A prompt-injected GitHub issue title could drive Cline's Claude-based triage bot to execute arbitrary commands in CI, then use GitHub Actions cache poisoning to hijack nightly build workflows and steal VS Code Marketplace, OpenVSX, and npm publishing tokens. This chain could have enabled a massive supply-chain attack on millions of developers via malicious extension or CLI updates.