CVE-2026-58497 in Uni-CLI
Summary
by MITRE • 10/23/2026
Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in Uni-CLI prior to version 0.225.2 represents a significant breach of the browser-to-localhost security boundary, specifically affecting the legacy JSON-RPC-over-HTTP Model Context Protocol transport mechanism. In modern web application architectures and local development tools, it is a fundamental security principle that resources bound to loopback interfaces should not be accessible from remote or untrusted origins without explicit validation. Uni-CLI was designed to provide a unified command interface for various environments including websites, browsers, desktop applications, and local tools via the Model Context Protocol. However, the implementation of the legacy HTTP transport failed to enforce strict origin checks when handling incoming requests on the loopback address. This architectural oversight allowed any web page loaded in a user's browser to interact directly with the local Uni-CLI server instance, bypassing standard cross-origin restrictions that typically protect localhost services from external interference.
The technical flaw centers on the absence of Origin header validation within the legacy JSON-RPC-over-HTTP handler. When a malicious actor hosts a webpage designed to exploit this weakness, they can craft a Cross-Origin Resource Sharing simple POST request with a content type such as text/plain. Despite the cross-origin nature of the request, the Uni-CLI server accepted it because it did not verify that the Origin header matched an expected local or trusted source before routing the payload to the JSON-RPC dispatcher. This lack of validation effectively neutralized the protective barrier intended by binding the service to localhost, as browsers do not block simple POST requests from cross-origin sources unless specific preflight conditions are met, which were circumvented here due to the server's permissive configuration. Consequently, an attacker could deliver a structured JSON-RPC body directly into the dispatcher logic of the local Uni-CLI instance.
The operational impact of this vulnerability is severe for users who have started the local MCP HTTP transport while browsing potentially malicious websites. Once the request reaches the dispatcher, it can drive tools and call requests against the user's local environment as if they originated from a trusted source. This means that an attacker could remotely invoke commands or access data through Uni-CLI without any additional authentication or consent prompts beyond those required to load the webpage itself. It is important to note that this vulnerability specifically addresses the browser-to-localhost boundary and does not alter the underlying local-code-execution trust model of Uni-CLI, which inherently assumes a high level of privilege for code running locally. Nevertheless, the ability for remote web pages to execute actions via the CLI interface expands the attack surface significantly, allowing for potential unauthorized automation, data exfiltration through tool outputs, or disruption of local workflows depending on the capabilities exposed by the connected tools and agents.
This issue highlights a common pattern in software development where different transport mechanisms within the same application may drift in their security postures over time. In this case, the Streamable HTTP transport correctly enforced browser-to-localhost boundaries, but the legacy stateless HTTP path did not maintain parity with these stricter controls. This inconsistency created an exploitable gap that attackers could leverage by targeting the less secure pathway. The vulnerability is classified under CWE-942 as Permissive Cross-Origin Resource Sharing and aligns with ATT&CK technique T1505, specifically Server Message Block (SMB) or Web Services Discovery if considering local service enumeration, though more accurately it fits within lateral movement or remote command execution contexts enabled by misconfigured web services. The remediation for this issue was implemented in version 0.225.2 of Uni-CLI, where the legacy transport was updated to validate Origin headers appropriately, thereby restoring the intended security boundary and preventing unauthorized cross-origin interactions with local tools and agents.