CVE-2026-59723: Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

The Cline Hub dashboard server (@cline/cline-hub), launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOM_SECRET is not set—the default for local (127.0.0.1) binds—isAuthorizedBrowserRequest() returns true unconditionally, allowing any website a developer visits to open a cross-origin WebSocket to ws://127.0.0.1:8787/browser. An attacker-controlled page can then send desktopCommand frames to read workspace/session state, mutate MCP and provider settings, and—because dashboard sessions default to autoApprove: true for all tools—trigger arbitrary command execution when a provider/model is configured. Dynamically confirmed: an upsert_mcp_server frame injected a malicious stdio MCP server entry into the victim’s Cline settings file with ok: true response.