Clinejection: A GitHub Issue Title Hijacked Cline's AI Triage Bot and Led to a Rogue npm Release

What happened

On 9 February 2026, security researcher Adnan Khan published Clinejection, a chain that started with the title of a GitHub issue and ended at the publishing credentials of Cline, an open-source AI coding assistant. Since 21 December 2025, Cline's repository had run an AI issue-triage workflow built on Anthropic's claude-code-action. Any GitHub account could trigger it by opening an issue, and the agent it launched had a shell. Khan reported the flaw privately on 1 January; Cline later acknowledged it did not act until he disclosed it publicly, then removed the workflow within about half an hour and began rotating its publishing tokens.

The rotation missed one. Cline deleted the wrong npm token, and on 17 February an unknown party used the exposed one to publish [email protected]. The CLI code was unchanged; the only addition was an install-time script that globally installed OpenClaw, a separate open-source AI agent. The release was live for about eight hours and, by StepSecurity's estimate reported by The Hacker News, was downloaded about 4,000 times before Cline shipped 2.4.0, deprecated 2.3.0 and revoked the right token. The VS Code and JetBrains extensions were not affected. Khan says another actor found his proof of concept on his test repository; who published 2.3.0 has not been confirmed.

How the attack worked

The triage prompt cast the model as a first responder for new issues and pasted in the issue number, author and title. The title was attacker text inside the instructions. Khan showed that a title written to look like a tool error could direct the agent to install a package from an attacker-controlled fork, and in his tests on a mirror of the repository the agent ran it every time. With Bash among its allowed tools, that meant arbitrary code execution inside a workflow on the default branch.

The triage job's own GitHub token was restricted, so the second step was a pivot. GitHub Actions caches are shared across workflows in the same scope. Code running in a low-privilege job can fill the cache past its 10 GB limit so older entries are evicted, then write poisoned entries under the keys a more privileged workflow expects. Cline's nightly publish workflows restored cached node_modules and held the VS Code Marketplace, OpenVSX and npm publish tokens. Those nightly tokens were not narrower than production ones: marketplace tokens are tied to the publisher, and Cline used the same npm package for nightly and production releases.

Root cause

• Attacker text in the prompt: the issue title was interpolated straight into the agent's instructions, with nothing separating it from the operator's prompt.
• Open trigger, broad tools: the action accepted runs from any user, and a triage task was given shell, file-write and web tools.
• Shared CI state: the triage job and the nightly publish jobs used the same Actions cache, so code execution in the weakest job could reach the strongest secrets.
• Unverified rotation: Cline checked a management page rather than the token itself, so the leaked credential outlived the fix.

What a test would have caught

Open an issue whose title asks the triage agent to do something harmless and observable, such as writing a marker file, and check whether it happens. That one test exposes both the injection and the shell. Asking which jobs share a cache with the release workflow exposes the pivot without any cache-poisoning tooling. And after rotating a credential, try the old one: the supposedly revoked npm token would have still worked.

How to prevent it

• Treat issue, pull-request and comment text as untrusted data, kept out of the instructions. Delimiting lowers the risk without removing it.
• Give triage agents triage tools. Reading and labelling issues needs no shell; Cline says future automation will be read-only with no shell access.
• Restrict who can trigger an agent with write-capable tools, and keep it away from caches that release jobs use.
• Keep caches out of publishing workflows and replace long-lived publish tokens. Cline did both, moving npm publishing to OIDC provenance through GitHub Actions.
• Verify rotation against the credential, not a dashboard.