Executive brief
Uni-CLI is a command-line tool used for managing Model Context Protocol (MCP) services. A security flaw in its legacy web transport allowed malicious websites to send unauthorized commands to a user's local Uni-CLI server if they visited a compromised page. This could allow an attacker to remotely execute tools or access data on the user's local machine through their web browser.
Technical details
Uni-CLI versions prior to 0.225.2 are vulnerable to a Cross-Site Request Forgery (CSRF) / Origin Validation Error (CWE-346). The legacy JSON-RPC-over-HTTP MCP transport failed to validate browser 'Origin' headers for requests arriving on the loopback interface. An attacker can leverage a malicious webpage to issue CORS-simple POST requests (e.g., text/plain) to the local /mcp endpoint. If the local MCP HTTP transport is active, the attacker can trigger 'tools/call' requests against the local dispatcher. The issue was resolved in version 0.225.2 by implementing a shared guard that enforces strict Origin policy checks before routing.
Affected products
- olo-dot-io Uni-CLI < 0.225.2
Timeline
- 2026-06-19: disclosed
- 2026-06-19: patched: Fixed in version 0.225.2
- 2026-06-19: advisory