CVE-2026-58497: 
JavaScript vulnerability analysis and mitigation

CVE-2026-58497 is a browser-to-localhost CSRF/Origin validation vulnerability in Uni-CLI (npm package @zenalexa/unicli) that allows malicious web pages to send unauthorized JSON-RPC requests to a locally running MCP HTTP server. All versions before 0.225.2 are affected. The vulnerability was reported privately by Ryan Vonbrubeck (@dodge1218) and disclosed on June 19, 2026. It carries a CVSS v4 base score of 8.6 (High) (GitHub Advisory, Uni-CLI Advisory).

The root cause is an Origin Validation Error (CWE-346) combined with Cross-Site Request Forgery (CWE-352): the legacy JSON-RPC-over-HTTP MCP transport in Uni-CLI bound to the loopback interface but did not validate the Origin header of incoming HTTP requests before routing them. This allowed a malicious web page to issue a CORS "simple" POST request (e.g., with Content-Type: text/plain) to http://localhost/mcp, bypassing browser CORS preflight checks, and deliver a valid JSON-RPC body directly to the MCP dispatcher. The Streamable HTTP transport had already implemented Origin enforcement, but the legacy stateless HTTP path had not, causing a security drift between the two transports. No authentication or special privileges are required beyond the victim having the legacy HTTP MCP transport running (GitHub Advisory, Uni-CLI Advisory).

A successful exploit allows a malicious web page visited by the victim to drive arbitrary tools/call requests against the user's local Uni-CLI MCP server, with high impact to both confidentiality and integrity of the vulnerable system. Depending on the tools registered with the MCP server, an attacker could read sensitive local data, modify files, or trigger actions on behalf of the user without their knowledge. Availability is not directly impacted, and the vulnerability does not alter Uni-CLI's existing local-code-execution trust model (GitHub Advisory, Uni-CLI Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. Exploitation requires passive user interaction — the victim must visit a malicious web page while the legacy HTTP MCP transport is running locally. The vulnerability is network-reachable with low attack complexity and requires no privileges, making it relatively straightforward to exploit once a victim is lured to a malicious page. No EPSS score or CISA KEV catalog entry has been identified for this CVE (GitHub Advisory, Uni-CLI Advisory).

1. Reconnaissance: Identify a target user running Uni-CLI with the legacy HTTP MCP transport enabled (i.e., @zenalexa/unicli < 0.225.2 started with the HTTP transport option, listening on http://localhost/mcp).
2. Craft malicious page: Create a web page that issues a cross-origin POST request to http://localhost/mcp using a CORS-simple content type such as text/plain to avoid triggering a CORS preflight check.
3. Deliver JSON-RPC payload: Embed a valid JSON-RPC body in the POST request body targeting a desired MCP tool, for example: {"jsonrpc":"2.0","method":"tools/call","params":{"name":"<tool_name>","arguments":{...}},"id":1}.
4. Lure victim: Trick the target user into visiting the malicious web page (e.g., via phishing, malicious ad, or compromised site) while their local Uni-CLI MCP HTTP server is running.
5. Achieve objective: The browser sends the POST request to http://localhost/mcp; the unpatched server routes it without Origin validation, executing the specified tool call with the user's local privileges and returning results to the attacker-controlled page (GitHub Advisory, Uni-CLI Advisory).

• Network: Unexpected POST requests to http://localhost/mcp or http://127.0.0.1/mcp originating from a browser process with a non-localhost Origin header present in server-side logs.
• Logs: Uni-CLI server logs showing tools/call JSON-RPC requests that were not initiated by the user or a known MCP client; requests with Content-Type: text/plain containing JSON-RPC bodies.
• Process: Unusual child processes or file system activity spawned by the Uni-CLI process shortly after unexpected tools/call invocations, depending on the tools registered with the MCP server.

Upgrade @zenalexa/unicli to version 0.225.2 or later, which moves the Origin policy into a shared guard applied before routing in both HTTP transports, rejecting non-loopback browser Origins with HTTP 403. If immediate upgrade is not possible, avoid using the legacy HTTP MCP transport and switch to the default stdio transport or the Streamable HTTP transport, both of which are not affected. Non-browser clients that omit the Origin header continue to function normally after the patch (GitHub Advisory, Uni-CLI Advisory).