CVE-2026-58497 Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A maliciou...

CVE-2026-58497

Prior to version 0.225.2 , Uni-CLI (specifically the @zenalexa/unicli package) is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of browser Origin header validation on its legacy JSON-RPC-over-HTTP MCP transport. A malicious web page can bypass the browser-to-localhost boundary b...

CVE-2026-58497 Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A maliciou...