Executive brief
Uni-CLI is a command-line tool that can expose a local HTTP interface for remote access and tool execution. Versions before 0.225.2 failed to validate browser Origin headers on this interface, allowing a malicious website to send JSON-RPC requests to the local service and execute commands without the user's awareness. An attacker could perform actions as the logged-in user if they visit a compromised page.
Technical details
The vulnerability is a missing Origin header validation (CWE-346, CWE-352) in the legacy JSON-RPC-over-HTTP MCP transport. When a user runs Uni-CLI with the HTTP transport exposed on localhost, the service did not validate the Origin header before routing incoming POST requests to the /mcp endpoint. A CORS-compliant simple request (e.g., text/plain content-type) from a browser context could deliver a JSON-RPC payload and trigger tool/call operations. The Streamable HTTP transport already enforced this check, but the legacy stateless path did not. The fix (version 0.225.2) applies a shared Origin guard that rejects non-loopback browser Origins with HTTP 403 before routing, while continuing to support non-browser clients that omit Origin.
Affected products
- ZenAlexa Uni-CLI before 0.225.2
Timeline
- 2026-06-19: disclosed
- 2026-06-19: patched: Version 0.225.2 released