STUPID-2026-0030

Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner

10.0critical
February 15, 2026Verified

  1. Instruction given

    Automatically triage incoming GitHub issues with an AI agent.

  2. Expected behavior

    Treat issue text from arbitrary users as untrusted input; never let it drive privileged actions or command execution on the runner.

  3. Actual behavior

    Cline's AI-powered issue-triage workflow fed untrusted issue content to an agent that could act on it, allowing a crafted issue to achieve arbitrary code execution on the CI runner with access to the workflow's secrets.

  4. Damage

    Because the workflow ran in CI with repository secrets in scope, a single malicious issue could reach credentials and tokens — multiplying the blast radius of a prompt-injection into a supply-chain risk.

The 'Clinejection' incident, disclosed in February 2026, showed how AI agents wired into CI/CD multiply risk. Cline had added an AI-powered issue-triage workflow in December 2025 that used an automated code action to respond to GitHub issues. Because issue text comes from arbitrary, untrusted users, a crafted issue could inject instructions that drove arbitrary code execution on the runner — with access to whatever secrets and credentials the workflow held. It is a canonical example of prompt injection escalating into a supply-chain problem the moment an agent is given the ability to act on untrusted input in a privileged environment.

Classification

Agent
Cline
Failure mode
Security Vulnerability
Root cause
Tool Misuse
Domain
Infra
Source
News Report

Related incidents

10.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
10.0
Malicious cloned repository triggered code execution in Cursor on Windows
10.0
AI vibe-coded Next.js app pinned vulnerable dependency — cryptominer compromised production server
10.0
GitHub Copilot suggested 2,702 valid secrets — 33% of extracted keys were real, live credentials
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.