Live › vulnerability › CVE-2026-58497
Go to dashboardUni-CLI (@zenalexa/unicli) before 0.225.2 served its legacy JSON-RPC-over-HTTP MCP transport (POST /mcp on loopback) without checking the browser Origin header. A web page could send a CORS-simple POST (text/plain, no preflight) and drive tools/call against the user's local Uni-CLI. It only applies if the user started that HTTP transport. Stdio (the default) and the Streamable transport were not affected, because Streamable already enforced Origin checks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product |
|---|
| Ecosystem |
|---|
| Affected |
|---|
| Fixed in |
|---|
| @zenalexa/unicli | npm | < 0.225.2 | 0.225.2 |
npm ls -g @zenalexa/unicli or unicli --version0.225.2 are affectedunicli mcp serve --transport http (default port 19826, endpoint POST /mcp; the flag comes from the v0.208.0 release commit)lsof -iTCP:19826 -sTCP:LISTEN or ps aux | grep "mcp serve"--transport http--transport streamable setups are not exposed--transport sse is an alias for Streamable, but I did not confirm whether older versions routed it to the legacy path0.225.2 or later (npm install -g @zenalexa/unicli@latest)--transport streamable instead of the legacy HTTP transportEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-58497")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.