{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0410",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "cline 2.3.0 postinstall installs OpenClaw without consent",
  "details": "## What\n\ncline 2.3.0 was published through a compromised npm token and its postinstall ran npm install -g openclaw@latest. The release demonstrates agent-CLI supply-chain compromise: a package update changed the host environment without an explicit user request for the added tool.\n\n## Which configuration is exposed\n\nThe exposed setup is an MCP or package-backed Cline installation that resolves exactly 2.3.0 and permits npm lifecycle scripts. A user need not have configured OpenClaw before the postinstall runs; the package supplies the command and global install itself.\n\n## How ACVE detects it\n\nACVE matches the resolved Cline package and exact version in one MCP server entry. Static discovery cannot observe lifecycle execution or determine whether the global install succeeded, so the match identifies exposure to the release.\n\n## Fix\n\nRemove Cline 2.3.0, uninstall the unexpected global OpenClaw package, and rotate credentials available during the postinstall. Rebuild from a trusted Cline release with lifecycle review and inspect shell history and package logs.\n\n## Grounding needed\n\nThe GitHub advisory should confirm the exact release window and package behaviour. The reported install count is retained as an install count, not a victim total.\n\nThis record is limited to the condition named in the public source: cline 2.3.0 postinstall installs OpenClaw without consent. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "cline"
      },
      "versions": [
        "2.3.0"
      ],
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "supply-chain",
        "command-injection"
      ],
      "cwe": [
        "CWE-78"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://github.com/cline/cline/security/advisories/GHSA-9ppg-jx86-fqw7",
            "type": "vendor"
          }
        ],
        "kev": {
          "listed": false
        },
        "first_seen": "2026-02-17",
        "last_seen": "2026-02-17",
        "victims": {
          "count": 4000,
          "range": ">4,000 installs",
          "sectors": [
            "software"
          ],
          "evidence": "The vendor advisory documents the compromised publish token and unwanted global package install."
        },
        "attribution": "stolen npm token"
      },
      "cveBoundary": "supply-chain",
      "matcher": {
        "some": "mcpServers",
        "where": {
          "all": [
            {
              "field": "package",
              "op": "eq",
              "value": "pkg:npm/cline"
            },
            {
              "field": "resolvedVersion",
              "op": "eq",
              "value": "2.3.0"
            }
          ]
        }
      },
      "fix": {
        "summary": "Remove cline 2.3.0 and review global OpenClaw installation.",
        "actions": [
          {
            "type": "remove",
            "target": "npm:cline@2.3.0"
          },
          {
            "type": "remove",
            "target": "npm:openclaw"
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:17:38Z",
          "sources": [
            {
              "url": "https://github.com/cline/cline/security/advisories/GHSA-9ppg-jx86-fqw7",
              "status": 200,
              "contentType": "text/html; charset=utf-8",
              "sha256": "sha256:1263ecb785c63dc36c36d79fd1acf89cf3ee4d65b37ed91bf25350832c74fafd",
              "type": "vendor"
            }
          ],
          "kev": {
            "listed": false
          }
        }
      }
    }
  }
}