Uni Cli
Monthly
Uni-CLI before 0.225.2 leaves the legacy stateless JSON-RPC-over-HTTP MCP transport listening on loopback without validating browser Origin headers, so a malicious page loaded in a browser on the same host can send a CORS simple POST (for example with Content-Type text/plain) to the local /mcp endpoint and reach the JSON-RPC dispatcher, driving tools/call requests against the user's local server. The flaw is unauthenticated (PR:N in the assessed vector) but requires user interaction - the victim must open the attacker's page - and only applies when the user has explicitly started the non-default legacy HTTP MCP transport; the stdio default and the Streamable HTTP transport, which already enforced the boundary, are not affected. Patched in 0.225.2; no public exploit code has been identified at time of analysis, and the issue is confined to the browser-to-localhost boundary rather than changing Uni-CLI's local-code-execution trust model.
Uni-CLI before 0.225.2 leaves the legacy stateless JSON-RPC-over-HTTP MCP transport listening on loopback without validating browser Origin headers, so a malicious page loaded in a browser on the same host can send a CORS simple POST (for example with Content-Type text/plain) to the local /mcp endpoint and reach the JSON-RPC dispatcher, driving tools/call requests against the user's local server. The flaw is unauthenticated (PR:N in the assessed vector) but requires user interaction - the victim must open the attacker's page - and only applies when the user has explicitly started the non-default legacy HTTP MCP transport; the stdio default and the Streamable HTTP transport, which already enforced the boundary, are not affected. Patched in 0.225.2; no public exploit code has been identified at time of analysis, and the issue is confined to the browser-to-localhost boundary rather than changing Uni-CLI's local-code-execution trust model.