CVE-2026-81735 in UI-TARS-desktop
Summary
by MITRE • 08/27/2026
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are applied only when a caller supplies them. The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call startSseAndStreamableHttpMcpServer with a host and port alone and pass no middleware, so neither server required a credential. The commands server exposes a run_command tool that hands its caller-supplied command string to promisify(child_process.exec), so any unauthenticated client able to reach the port could run arbitrary commands as the user running the server, and the filesystem server exposed its file read and write tools on the same terms. The listen default became 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168; the package version stayed at 1.2.4 across that change, so the boundary is the commit rather than a release.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability in UI-TARS-desktop stems from a critical misconfiguration within the mcp-http-server package, specifically involving the startServer.ts module and its interaction with Streamable HTTP and Server-Sent Events transports. When no explicit host address was provided during initialization, the server defaulted to binding on '::', which represents all IPv6 interfaces including localhost and external network adapters. This behavior effectively exposed internal services to any network interface accessible by the operating system, bypassing standard local-only restrictions that are typically expected for desktop application components communicating with agent infrastructure. The authentication middleware designed to secure these endpoints was implemented as an optional parameter rather than a mandatory security control. Consequently, if no middleware array was supplied during server instantiation, the resulting HTTP and SSE endpoints operated without any form of credential verification or access control enforcement.
This architectural flaw directly impacted two specific entry points: agent-infra/mcp-server-commands and agent-infra/mcp-server-file system. Both modules invoke startSseAndStreamableHttpMcpServer by providing only the host and port parameters, deliberately omitting any authentication middleware configuration. As a result, both servers launched with no security barriers protecting their exposed tools. The commands server exposes a run_command tool that accepts user-supplied command strings and executes them via promisify(child_process.exec). This mechanism allows for arbitrary code execution on the underlying operating system shell. Similarly, the filesystem server provides read and write capabilities that allow unauthenticated actors to manipulate files within the context of the running application process. Because these services were bound to all interfaces without authentication, any client capable of reaching the designated port could interact with these dangerous functionalities remotely or locally depending on network configuration.
The operational impact is severe, constituting a remote code execution vulnerability for local users and potentially remote attackers if the machine has exposed ports due to firewall misconfigurations or NAT traversal scenarios typical in certain enterprise environments. An attacker who gains access to the loopback interface or any other accessible network segment can invoke arbitrary system commands with the privileges of the user account running UI-TARS-desktop. This includes reading sensitive configuration files, modifying application data, installing malware, or pivoting to further attacks within the local environment. The vulnerability aligns with CWE-284 Improper Access Control and CWE-78 OS Command Injection, reflecting both the lack of authentication enforcement and the unsafe execution of user-supplied input as system commands. In terms of MITRE ATT&CK mapping, this scenario corresponds to T1059 Command and Scripting Interpreter for code execution and potentially T1046 Network Service Discovery if used to probe for other vulnerable services on the host.
The root cause was identified in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168, which changed the default listen address from '::' to '127.0.0.1'. However, because this change occurred within a single package version (1.2.4) without a corresponding semantic version bump or release cycle boundary, traditional vulnerability tracking based on versions may fail to capture the exact point of introduction. This highlights the importance of commit-level granularity in security auditing for rapidly developed desktop applications. Mitigation requires ensuring that all server instances explicitly bind to localhost by default and enforce mandatory authentication middleware regardless of caller input. Developers should implement a secure-by-default configuration pattern where access control is enabled unless explicitly disabled with strong justification, rather than relying on optional parameters to provide critical security functions.