CVE-2026-30312

Deeper analysis

CVE-2026-30312 is a critical OS command injection vulnerability (CWE-78) in the command auto-approval module of DSAI-Cline, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The module uses string-based parsing to enforce a whitelist, blocking dangerous operators like ;, &&, ||, |, and command substitution patterns. However, it fails to detect raw newline characters embedded in inputs, allowing attackers to bypass validation entirely. When processed by the underlying PowerShell interpreter, the newline acts as a command separator, enabling sequential execution of both a whitelisted command and injected malicious code.

A remote attacker with network access to DSAI-Cline can exploit this vulnerability without authentication or user interaction by crafting a payload that inserts a literal newline between a whitelisted command and arbitrary malicious code, such as "git log\nmalicious_command". The auto-approval mechanism misidentifies the input as safe due to the whitelisted prefix, approving it automatically. PowerShell then executes the full payload, resulting in remote code execution with high confidentiality, integrity, and availability impacts.

Advisories and further details are available in the referenced GitHub repositories: https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/9 and https://github.com/necboy/cline-DSAI. These sources document the issue in the context of LLM tool-calling vulnerabilities.