Uni-CLI vulnerabilities

CVEs whose affected-version data names the Uni-CLI package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-58497High· 8.6

yesterday

Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validatin…

▾ Twilightolo-dot-io · Uni-CLIvia CVEORG