{"id":"CVE-2026-58497","kind":"vulnerability","aliases":["CVE-2026-58497"],"related":[],"title":"Uni-CLI: a malicious web page can drive local MCP tool calls","description":"Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.","summary":"Uni-CLI (@zenalexa/unicli) before 0.225.2 served its legacy JSON-RPC-over-HTTP MCP transport (POST /mcp on loopback) without checking the browser Origin header. A web page could send a CORS-simple POST (text/plain, no preflight) and drive tools/call against the user's local Uni-CLI. It only applies if the user started that HTTP transport. Stdio (the default) and the Streamable transport were not affected, because Streamable already enforced Origin checks.","severity":"high","cvss":8.6,"epss":0.00272,"exploited":false,"exploited_at":null,"products":[{"name":"@zenalexa/unicli","fixed":["0.225.2"],"affected":"< 0.225.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","browser","local-dev","mcp","npm","uni-cli"],"not_affected_if":["mcp-http-not-running","mcp-http-transport-not-started","stdio-transport","streamable-transport","version-0.225.2-or-later"],"how_to_check":"Run 'npm ls -g @zenalexa/unicli' or 'unicli --version'. Versions below 0.225.2 are affected. You are exposed only if the legacy HTTP transport is running: it is started with 'unicli mcp serve --transport http' (default port 19826, endpoint POST /mcp; the flag comes from the v0.208.0 release commit). Look for a listener with 'lsof -iTCP:19826 -sTCP:LISTEN' or 'ps aux | grep \"mcp serve\"'. Also check MCP client configs and scripts for '--transport http'. Stdio or '--transport streamable' setups are not exposed. In current docs '--transport sse' is an alias for Streamable, but I did not confirm whether older versions routed it to the legacy path.","fix":"Upgrade to @zenalexa/unicli 0.225.2 or later (npm install -g @zenalexa/unicli@latest). That version applies the Origin guard to both HTTP transports and returns 403 for non-loopback browser Origins; clients that omit Origin still work. Workaround: use the default stdio transport or '--transport streamable' instead of the legacy HTTP transport.","status":"open","published_at":"2026-10-23T15:17:34+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:39:10+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:39:10Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Uni-CLI to version 0.225.2 or later.\nunknown","reach":"local","title":"Uni-CLI: a malicious web page can drive local MCP tool calls","impact":"high","summary":"Uni-CLI's legacy MCP HTTP endpoint on localhost skipped browser Origin checks, so a web page can send a simple cross-origin POST and invoke tools. An attacker gets to run Uni-CLI tool calls on the user's machine when the local MCP HTTP transport is running.","category":"ai-tooling","who_cares":["uni-cli","mcp","local-dev","browser"],"confidence":0.8,"needs_auth":"no","worst_case":"web page drives local Uni-CLI tool calls on the user's machine","analyst_note":"Confirm the exact flag or command that starts the legacy MCP HTTP transport and how to detect it running; see https://nvd.nist.gov/vuln/detail/CVE-2026-58497.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["mcp-http-transport-not-started","version-0.225.2-or-later"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000528,"input_tokens":3129,"output_tokens":430,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the exact flag or command that starts the legacy MCP HTTP transport and how to detect it running; see https://nvd.nist.gov/vuln/detail/CVE-2026-58497.","search":"'-2026':15A,18A '-58497':16A,19A '/mcp':50B,172C '0.225.2':38B,131C,266C 'affect':102B 'agent':115C 'ai':22B 'ai-tool':21B 'alreadi':105B,213C 'appli':85B 'applic':123C 'bodi':180C 'boundari':220C,244C 'browser':24B,56B,121C,149C,217C,241C 'browser-to-localhost':216C,240C 'call':13A 'chang':248C 'check':54B,108B 'cli':3A,32B,35B,82B,111C,134C,207C,251C 'code':255C 'command':117C 'cor':66B,162C 'cors-simpl':65B 'could':62B,159C,196C 'cve':14A,17A 'default':95B 'deliv':175C 'desktop':122C 'dev':27B 'dispatch':183C 'drift':234C 'drive':9A,73B,197C 'endpoint':173C 'enforc':106B,214C 'execut':256C 'expos':135C 'give':112C 'header':58B,151C 'http':46B,91B,142C,192C,211C,224C,231C 'interfac':118C 'issu':236C,260C 'json':43B,139C,178C 'json-rpc':177C 'json-rpc-over-http':42B,138C 'legaci':41B,137C,222C 'local':10A,26B,79B,124C,171C,190C,204C,254C 'local-code-execut':253C 'local-dev':25B 'localhost':219C,243C 'loopback':52B,146C 'malici':5A,156C 'mcp':11A,28B,47B,127C,143C,191C 'model':258C 'npm':29B 'one':116C 'origin':57B,107B,150C 'page':7A,61B,158C,195C 'patch':263C 'path':225C 'peopl':113C 'post':49B,68B,164C 'preflight':71B 'prior':128C 'request':154C,165C,199C 'rout':153C 'rpc':44B,140C,179C 'send':63B,160C 'serv':39B 'server':208C 'simpl':67B,163C 'start':89B,188C 'stateless':223C 'stdio':93B 'streamabl':98B,104B,210C 'text/plain':69B,168C 'tool':12A,23B,125C 'tools/call':74B,198C 'transport':48B,92B,99B,144C,193C,212C,232C 'trust':257C 'two':230C 'uni':2A,31B,34B,81B,110C,133C,206C,250C 'uni-c':1A,30B,33B,80B,109C,132C,205C,249C 'user':77B,88B,186C,202C 'valid':148C 'version':130C,265C 'web':6A,60B,157C 'websit':120C 'without':53B,147C 'zenalexa/unicli':20A,36B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58497","severity":null,"published_at":"2026-10-23T15:17:34+00:00","modified_at":"2026-10-23T21:17:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-58497:278","url":null,"severity":null,"published_at":"2026-10-23T22:42:10+00:00","modified_at":"2026-10-23T22:42:10+00:00","first_seen_at":"2026-10-23T22:42:10+00:00","fetched_at":"2026-10-23T22:42:10+00:00","note":"Read GHSA-v3f4-w7r7-v3hm, v0.225.2 release and fix commit. Legacy transport flag from v0.208.0 commit (--transport http, port 19826); current docs not explicit, so confirm in the installed version. No PoC or exploitation found. Social search not done."},{"source":"epss","external_id":"CVE-2026-58497","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58497","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":1570,"url":"https://github.com/olo-dot-io/Uni-CLI/security/advisories/GHSA-v3f4-w7r7-v3hm","title":"GHSA-v3f4-w7r7-v3hm: Legacy HTTP MCP transport accepted browser-originated localhost requests","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1571,"url":"https://github.com/olo-dot-io/Uni-CLI/releases/tag/v0.225.2","title":"Uni-CLI v0.225.2","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1572,"url":"https://github.com/olo-dot-io/Uni-CLI/commit/d675c267d24780e82b09e92c009f8b8dc6b51b16","title":"Fix commit d675c26: validate Origin on legacy HTTP transport","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1573,"url":"https://github.com/olo-dot-io/Uni-CLI/commit/a1e75cb2c2e8ba2ad4e41281acfdd3bd8a36379a","title":"v0.208.0 release commit: introduces --transport http on port 19826","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}