Disclosed vulnerability
Cline coding agent leaks .env secrets via markdown image rendering during prompt injection
AIR-2025-0123 AIR record · 2025-08-cline-data-exfiltration
From the supporting source
This allows an adversary to exfiltrate sensitive user information during a prompt injection attack by reading sensitive data (e.g. .env file) and appending its contents to the URL of an image.embracethered.com
The record
Disclosed
2025-08-27
Vendor
Cline (open source)
Product
Cline
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Confused deputy
System type
Generative model
Who acted
Agent acted — Cline read .env and rendered the exfiltration image
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection source code
Impact type
Data exfiltration, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Cline users (2M+ downloads at the time)
Capability abused
Defense & remediation
Recorded defense
none (no CSP restricting image domains)
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
unpatched at publication; reported 2025-05-29, disclosed after 90+ days with no substantive response
Taxonomy & references
Curator notes
Month of AI Bugs. GitHub issue was opened and closed the same day without engagement. Also reported as: 'Cline coding agent vulnerable to data exfiltration via prompt injection'.
Supporting sources
Cite as
Enkrypt AI. "Cline coding agent leaks .env secrets via markdown image rendering during prompt injection". AIR, AIR-2025-0123. https://agentincident.vercel.app/i/AIR-2025-0123/ (accessed 2026-10-19).