MoLing EUVD-2026-114460

Exploitation requires the victim to be running MoLing in SSE mode, which is enabled only via the non-default -l/ListenAddr flag; stdio-mode deployments are not affected. While SSE mode is active, the victim must also visit an attacker-controlled web page (UI:R) with a browser that honors the mcp-go wildcard Access-Control-Allow-Origin: * header, which lifts the Same-Origin Policy and lets the page read the /sse stream and extract the unauthenticated sessionId. No credentials are needed by the attacker, and the advisory explicitly states that binding only to loopback (127.0.0.1) does NOT prevent the attack because it is browser-mediated from the victim's own machine. The concrete impact ceiling (local file read/write, command execution, or other actions) is bounded by which MCP tools are configured on that server. Limiting factors for defenders: the non-default SSE mode, the required user interaction, and the pre-0.5.0 version - version 0.5.0 adds mandatory bearer/query token authentication and strips the CORS header.

Multiple signals point to a genuinely high-priority issue, but the headline CVSS 9.6 overstates how broadly it can be triggered. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) correctly reflects an unauthenticated, low-complexity, network-reachable flaw whose scope change (S:C) is justified because the browser-mediated attack reaches across trust boundaries to the host's files and command execution via configured MCP tools. The vuln.today Decision label is act_now, and the vendor GHSA advisory confirms the root cause (no auth on /sse and /message plus a hardcoded Access-Control-Allow-Origin: * from the mcp-go dependency). No EPSS score and no CISA KEV entry were provided in the input, so there is no quantitative exploitation-probability signal and no evidence of active in-the-wild use - this reads as a serious but not-yet-exploited weakness rather than a mass-exploited one. Two factors meaningfully gate real-world risk and are NOT captured by the 9.6 number: exploitation requires the victim to be running in SSE mode (the non-default -l flag) AND to visit an attacker-controlled page (UI:R), which makes this targeted/opportunistic rather than wormable. Net: treat as act_now for anyone running MoLing in SSE mode, but the absence of EPSS/KEV data and the UI:R + non-default-mode preconditions mean this is a conditional high priority, not a universally wormable critical.

A victim runs MoLing in SSE mode (moling -l 127.0.0.1:6789) and, while it is running, browses to an attacker-controlled web page. Because the browser honors the wildcard CORS header, script on that page opens a cross-origin EventSource to the loopback /sse endpoint, reads the endpoint event to steal the unauthenticated sessionId, and then POSTs arbitrary MCP tool calls to /message - reading or writing local files or executing commands depending on the configured tools. The GHSA advisory includes a simplified JavaScript PoC demonstrating the sessionId extraction step.