Uni-CLI EUVD-2026-109090

Exploitation requires that the user has explicitly started Uni-CLI's legacy stateless JSON-RPC-over-HTTP MCP transport on loopback - this is NOT the default (stdio is default, and the Streamable HTTP transport already enforced the Origin boundary). The victim must then open an attacker-controlled web page in a browser on the same host, which sends a CORS simple POST (such as Content-Type text/plain) to the local /mcp endpoint; the legacy path did not validate the browser Origin header before routing, so the request reaches the dispatcher. Limiting factors: required user interaction (visiting the malicious page, UI:P), the non-default legacy HTTP transport must be running, and the issue is confined to the browser-to-localhost boundary - per the advisory it does not alter Uni-CLI's existing local-code-execution trust model. Requests from non-browser clients that omit Origin remain supported, so the condition is specifically browser-originated traffic.

Signals are moderately consistent and point to a real-but-conditional issue rather than an indiscriminate emergency. The CVSS 4.0 base score of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H) reflects a network-reachable, low-complexity, unauthenticated flaw whose high confidentiality and integrity impact comes from letting a web origin drive tools/call requests against the local server. The vuln.today decision label is 'this_week' (not act_now or emergency), which matches the picture: this is a prompt-patch item, not a drop-everything one. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified - this is a gap, not a low score. The vulnerability is NOT in CISA KEV and there is no confirmed public exploit; it was reported privately by a researcher (Ryan Vonbrubeck / @dodge1218), so there is no evidence of in-the-wild use. The practical risk is tempered by two preconditions encoded in the vector: UI:P (the victim must open a malicious web page) and the fact that the legacy HTTP MCP transport is non-default (stdio is default), so the attacker-reachable surface only exists when a user has deliberately started that transport. Net: a genuine browser-to-localhost CSRF/origin-validation bypass worth patching this week, but its real-world blast radius is limited by non-default configuration and required user interaction rather than being a wormable, widespread threat.

A developer has started Uni-CLI's legacy JSON-RPC-over-HTTP MCP transport on loopback and, in the same browser session, visits a malicious or compromised web page. That page issues a CORS simple POST (e.g. Content-Type text/plain) to http://localhost/mcp carrying a JSON-RPC body; because the legacy path did not validate the browser Origin header, the request reaches the dispatcher and can drive tools/call operations against the user's local Uni-CLI server. No public exploit code is identified at time of analysis; the issue was reported privately.