{"id":"CVE-2026-58497","revision":null,"records":[{"revision":"3cf4ae0a626746d2bb3054a08e19fdd6","observedAt":"2026-10-23T21:48:20.592+00:00","statement":{"source":"cve-program","id":"CVE-2026-58497","aliases":[],"title":"Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests","description":"Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.","state":0,"publishedAt":"2026-10-23T14:49:42.619+00:00","modifiedAt":"2026-10-23T20:57:14.612+00:00","affected":[{"ecosystem":"Vendor product","name":"Uni-CLI","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"olo-dot-io\",\n                    \"product\": \"Uni-CLI\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.225.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.6,"severity":"HIGH"}],"references":["https://github.com/olo-dot-io/Uni-CLI/security/advisories/GHSA-v3f4-w7r7-v3hm","https://github.com/olo-dot-io/Uni-CLI/releases/tag/v0.225.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-58497","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-58497","identifiers":["CVE-2026-58497"]},"retained":false,"historicalAffected":[]},{"revision":"b244478cf92b4624bae98c327f01bbc1","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-v3f4-w7r7-v3hm","aliases":["CVE-2026-58497"],"title":"Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests","description":"## Impact\n\nUni-CLI versions before 0.225.2 exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server.\n\nThe Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model.\n\n## Patches\n\nVersion 0.225.2 fixes the issue by moving the Origin policy into a shared guard and applying it before routing in both HTTP transports. Non-loopback browser Origins are rejected with HTTP 403 before health, OAuth, or /mcp dispatch runs. Non-browser clients that omit Origin remain supported.\n\n## Workarounds\n\nUpgrade to 0.225.2 or later. If upgrading is not immediately possible, do not expose the legacy HTTP MCP transport to browser-originated traffic; use the default stdio transport or the Streamable HTTP transport instead.\n\n## Credits\n\nReported privately by Ryan Vonbrubeck ([@dodge1218](https://github.com/dodge1218)).","state":0,"publishedAt":"2026-06-19T21:43:09+00:00","modifiedAt":"2026-10-24T02:56:07.9018891+00:00","affected":[{"ecosystem":"npm","name":"@zenalexa/unicli","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.225.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/olo-dot-io/Uni-CLI/security/advisories/GHSA-v3f4-w7r7-v3hm","https://github.com/olo-dot-io/Uni-CLI"],"sourceUrl":"https://github.com/advisories/GHSA-v3f4-w7r7-v3hm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-v3f4-w7r7-v3hm","identifiers":["GHSA-v3f4-w7r7-v3hm","CVE-2026-58497"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-24T16:17:13.5945497+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-24T16:17:13.5945497+00:00","lastSuccessAt":"2026-10-24T16:17:13.7819609+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.7819622+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-9b3cad78792c7367da03684feab05819ddebc4d137048bdbbdabdbb4d2879391-a9407c061ac75ced2d0a73c4e3748152394e8779db91b3a6e901673f00b86946","complete":true,"records":413905,"lastAttemptAt":"2026-10-24T16:17:13.1079997+00:00","lastSuccessAt":"2026-10-24T16:17:13.0175197+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.1079997+00:00","snapshotPublishedAt":"2026-10-24T15:24:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-fe53955cf43042a8ba628b299bd6d3a7","complete":false,"records":1672,"lastAttemptAt":"2026-10-24T16:29:19.9413572+00:00","lastSuccessAt":"2026-10-24T16:29:19.928+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:29:19.928+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":1700,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-24T16:17:13.5945497+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-24T16:17:13.5945497+00:00","lastSuccessAt":"2026-10-24T16:17:13.7827946+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.7827949+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cb8d4bef6e2747a9b59fe544580dd89c","complete":false,"records":1972,"lastAttemptAt":"2026-10-24T16:17:38.9368482+00:00","lastSuccessAt":"2026-10-24T16:17:38.932+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:38.932+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":2000,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-24T16:17:13.453426+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.453426+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-24T16:17:13.2532527+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.2532527+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-24T16:17:13.5544647+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.5544647+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-01c673643721642d348dd2cebd6ec154e69bb7cd20a86eeae91240dc3610a60f","complete":true,"records":230735,"lastAttemptAt":"2026-10-24T16:17:13.3536322+00:00","lastSuccessAt":"2026-10-24T13:19:32.2429544+00:00","error":null,"lastVerifiedAt":"2026-10-24T16:17:13.3536322+00:00","snapshotPublishedAt":"2026-10-24T04:48:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}