Loading the catalogue…
IDE extensions · Cline Bot Inc. · US
Cline
US CLOUD Act exposureOpen sourceApache-2.0
USAGE ON STAV · LAST 12 WEEKS
Where Cline shows up on Stav.
Live usage rolls up every five minutes. We surface the 12-week trend once enough requests have flowed through this app.
STAV REVIEW · LAST REVIEWED 06/21/2026
“The most widely deployed BYOI coding agent in VS Code, held at caution by an unpatched CVSS 9.6 WebSocket hijack now 44 days open.”
Good for
- Teams that want a proven autonomous coding agent wired directly to Stav Inference in BYOI mode, keeping code and prompts off vendor infrastructure entirely
- Engineering orgs on Apache-2.0 tooling that need no copyleft constraints on enterprise deployment
- Teams requiring on-premises or air-gapped deployment, SSO, and audit logging at the enterprise tier
- High-velocity shops that value a ~0.9-day release cadence and 25 active contributors as evidence of sustained maintenance
- Developers already in VS Code who want agentic file editing, terminal execution, and multi-step task coordination without switching IDEs
Watch out for
- CVE-2026-44211 (CVSS 9.6, unresolved at 44 days post-disclosure): the bundled Kanban server on port 3484 has no Origin header validation — any webpage visited while the extension is active can hijack the WebSocket, exfiltrate workspace data, or inject shell commands; disable the Kanban feature and treat all versions ≤2.13.0 as unsafe until the vendor confirms a patch and the advisory is marked resolved
- Managed-credits mode routes prompts and code through US-hosted Cline infrastructure with no stated retention period, creating confirmed CLOUD Act exposure; enforce BYOI mode by organisational policy — the extension does not restrict this by default
- No SOC 2, ISO 27001, or publicly available DPA exists; the GA status and compliance scope of the advertised enterprise controls (SSO, audit log, air-gapped) have not been independently verified beyond vendor marketing copy
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.
MODEL REQUIREMENTS
What Cline needs from a model.
Required
- Streaming
- Tool calling
Recommended
- Code-native
- Extended thinking
- Long context (≥128k)
Known issues8 open
Public security, privacy and governance advisories that are still open. Each row carries a source link — these are factual claims, not editorial judgements.
2026-06-30
lowUpstream change on cline: github_release 'cli-v3.0.29' → 'v4.0.4', github_last_push '2026-06-23T06:32:31Z' → '2026-06-30T02:21:04Z', cve_count 2 → 3
other · open
Source ↗2026-06-23
lowUpstream change on cline: github_release 'cli-v3.0.24' → 'cli-v3.0.29', github_last_push '2026-06-16T06:19:30Z' → '2026-06-23T06:32:31Z'
other · open
Source ↗2026-06-16
lowUpstream change on cline: github_release 'cli-v3.0.21' → 'cli-v3.0.24', github_last_push '2026-06-09T05:50:26Z' → '2026-06-16T06:19:30Z'
other · open
Source ↗2026-06-09
lowUpstream change on cline: github_release 'v3.86.2' → 'cli-v3.0.21', github_last_push '2026-06-02T04:36:19Z' → '2026-06-09T05:50:26Z'
other · open
Source ↗2026-06-02
lowUpstream change on cline: github_release 'cli-v3.0.7' → 'v3.86.2', github_last_push '2026-05-19T06:02:26Z' → '2026-06-02T04:36:19Z'
other · open