---
id: "CVE-2026-58497"
kind: "vulnerability"
aliases: ["CVE-2026-58497"]
title: "Uni-CLI: a malicious web page can drive local MCP tool calls"
severity: "high"
cvss: 8.6
epss: 0.00272
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "@zenalexa/unicli", "fixed": ["0.225.2"], "affected": "< 0.225.2", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "browser", "local-dev", "mcp", "npm", "uni-cli"]
not_affected_if: ["mcp-http-not-running", "mcp-http-transport-not-started", "stdio-transport", "streamable-transport", "version-0.225.2-or-later"]
published_at: "2026-10-23T15:17:34+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58497", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:42:10+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-58497", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Uni-CLI: a malicious web page can drive local MCP tool calls

Uni-CLI (@zenalexa/unicli) before 0.225.2 served its legacy JSON-RPC-over-HTTP MCP transport (POST /mcp on loopback) without checking the browser Origin header. A web page could send a CORS-simple POST (text/plain, no preflight) and drive tools/call against the user's local Uni-CLI. It only applies if the user started that HTTP transport. Stdio (the default) and the Streamable transport were not affected, because Streamable already enforced Origin checks.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@zenalexa/unicli affected < 0.225.2 fixed 0.225.2

## How to check

Run 'npm ls -g @zenalexa/unicli' or 'unicli --version'. Versions below 0.225.2 are affected. You are exposed only if the legacy HTTP transport is running: it is started with 'unicli mcp serve --transport http' (default port 19826, endpoint POST /mcp; the flag comes from the v0.208.0 release commit). Look for a listener with 'lsof -iTCP:19826 -sTCP:LISTEN' or 'ps aux | grep "mcp serve"'. Also check MCP client configs and scripts for '--transport http'. Stdio or '--transport streamable' setups are not exposed. In current docs '--transport sse' is an alias for Streamable, but I did not confirm whether older versions routed it to the legacy path.

## Fix

Upgrade to @zenalexa/unicli 0.225.2 or later (npm install -g @zenalexa/unicli@latest). That version applies the Origin guard to both HTTP transports and returns 403 for non-loopback browser Origins; clients that omit Origin still work. Workaround: use the default stdio transport or '--transport streamable' instead of the legacy HTTP transport.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-58497
- 2026-10-23T22:42:10+00:00 analyst — Read GHSA-v3f4-w7r7-v3hm, v0.225.2 release and fix commit. Legacy transport flag from v0.208.0 commit (--transport http, port 19826); current docs not explicit, so confirm in the installed version. No PoC or exploitation found. Social search not done.
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-58497

## Documents

- [advisory] GHSA-v3f4-w7r7-v3hm: Legacy HTTP MCP transport accepted browser-originated localhost requests https://github.com/olo-dot-io/Uni-CLI/security/advisories/GHSA-v3f4-w7r7-v3hm
- [describes] v0.208.0 release commit: introduces --transport http on port 19826 https://github.com/olo-dot-io/Uni-CLI/commit/a1e75cb2c2e8ba2ad4e41281acfdd3bd8a36379a
- [fix] Uni-CLI v0.225.2 https://github.com/olo-dot-io/Uni-CLI/releases/tag/v0.225.2
- [fix] Fix commit d675c26: validate Origin on legacy HTTP transport https://github.com/olo-dot-io/Uni-CLI/commit/d675c267d24780e82b09e92c009f8b8dc6b51b16

## From the sources

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_