What happened
Uni-CLI's legacy stateless HTTP MCP transport lacked Origin validation on its loopback endpoint (CWE-346/CWE-352), while the Streamable HTTP transport already enforced the browser-to-localhost boundary — the two had drifted. A malicious page could drive tool calls against the local server. Fixed in 0.225.2. CVSS 8.6, published 2026-10-23.
Why it matters
It extends the browser-to-localhost attack class to MCP tool surfaces: an agent command interface that a web page can silently drive, invoking local tools (browser use, desktop apps, MCP servers) without the user's knowledge.
Attack vector
The legacy stateless JSON-RPC-over-HTTP MCP transport on loopback did not validate browser Origin headers before routing requests. A malicious page sends a CORS simple POST (e.g. text/plain) to the local /mcp endpoint with a JSON-RPC body, driving tool calls against the user's local Uni-CLI server if the user started the local MCP HTTP transport.
Affected systems
Uni-CLI before 0.225.2 (legacy JSON-RPC-over-HTTP MCP transport)
Mitigation
Upgrade to Uni-CLI 0.225.2 (patches the origin-validation gap for the legacy transport). Advisory GHSA-v3f4-w7r7-v3hm.