Uni‑CLI exposed a legacy JSON‑RPC‑over‑HTTP MCP transport on loopback that silently accepted requests without validating the browser Origin header. A malicious web page can send a simple CORS POST to localhost /mcp, delivering a JSON‑RPC payload that the dispatcher will execute. This allows the attacker to issue arbitrary Uni‑CLI tool calls on the victim’s local machine, effectively giving the attacker local code execution power. The vulnerability does not alter Uni‑CLI’s trust model for local code execution but removes the boundary that previously prevented browsers from targeting the local service.

The problem affects all versions of Uni‑CLI older than 0.225.2 that provide the legacy MCP transport on loopback. Users running olo‑dot‑io’s Uni‑CLI on any OS when the local MCP HTTP service is enabled are susceptible.

The CVSS score of 8.6 indicates high severity. The exploit is straightforward: a user must visit a malicious page while the local MCP service is running, and the browser will send the crafted POST without user permission. The EPSS score is not currently available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known large‑scale exploitation yet, but the ease of the attack vector leaves it highly actionable.