Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
Impact
Uni-CLI versions before 0.225.2 exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server.
The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model.
Patches
Version 0.225.2 fixes the issue by moving the Origin policy into a shared guard and applying it before routing in both HTTP transports. Non-loopback browser Origins are rejected with HTTP 403 before health, OAuth, or /mcp dispatch runs. Non-browser clients that omit Origin remain supported.
Workarounds
Upgrade to 0.225.2 or later. If upgrading is not immediately possible, do not expose the legacy HTTP MCP transport to browser-originated traffic; use the default stdio transport or the Streamable HTTP transport instead.
Credits
Reported privately by Ryan Vonbrubeck (@dodge1218).
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @zenalexa/unicli | < 0.225.2 | 0.225.2 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-346, CWE-352- Platform
- npm
- Package
@zenalexa/unicli- Disclosed
- 19.06.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-v3f4-w7r7-v3hm - CC BY 4.0
Vulnerability history: @zenalexa/unicli
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.