What happened
MoLing is an MCP server for computer-use and browser-use. When launched with -l (SSE mode), its /sse and /message endpoints are unauthenticated and the mcp-go dependency sets Access-Control-Allow-Origin: *. A malicious web page can therefore open a cross-origin EventSource to the local server, subscribe to its message stream, and drive the MCP tools without any credential or user consent.
Why it matters
This is a browser-drive-by against a local agent: a single hostile page can silently control a UI-automation agent. Because MoLing's tools can issue computer/browser actions and shell commands, this turns a developer's local agent into an arbitrary code-execution and data-exfil primitive, bypassing the 'localhost is safe' assumption.
Attack vector
The /sse and /message HTTP endpoints accept unauthenticated requests and mcp-go sets Access-Control-Allow-Origin: *, so a malicious web page can open a cross-origin EventSource to a locally-running MoLing instance and invoke MCP tools (including shell/computer-use tools) as the host user.
Affected systems
MoLing (gojue/moling) prior to 0.5.0 when running in SSE mode (-l)
Mitigation
Upgrade to MoLing 0.5.0; treat the local MCP server as a security boundary (bind to localhost, authenticate requests, restrict CORS origins). Fix commit: https://github.com/gojue/moling/commit/ae07f704cbc88d4419fc0fbaec278090fcd0502d