{"answers":{"affected":"2 open source packages ship an affected version, including @zenalexa/unicli.","exploited":"There is no known exploitation of CVE-2026-58497 in the wild and no public exploit code.","fix":"Upgrade @zenalexa/unicli to 0.225.2 or later.","what":"CVE-2026-58497 is a high-severity vulnerability in olo-dot-io Uni-CLI, published on 23 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-58497 and fix it if it is affected.\n\nWhat it is: CVE-2026-58497 is a high-severity vulnerability in olo-dot-io Uni-CLI, published on 23 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-58497 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @zenalexa/unicli (npm): affected all versions; fixed in 0.225.2\n- @zenalexa/unicli (npm): affected all versions; fixed in 0.225.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-58497/ (Markdown: https://insights.sbomify.com/CVE-2026-58497/index.md)","id":"CVE-2026-58497","markdown":"https://insights.sbomify.com/CVE-2026-58497/index.md","name":"CVE-2026-58497","record":{"aliases":["GHSA-v3f4-w7r7-v3hm"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[],"cvss":{"score":8.6,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"},{"id":"CWE-346","name":"Origin Validation Error"}],"description":"Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests","id":"CVE-2026-58497","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":2,"n_references":2,"next":{"headline":"Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id","id":"CVE-2026-58499"},"packages":[{"ecosystem":"npm","fixed":["0.225.2"],"introduced":["0"],"last_affected":[],"package":"@zenalexa/unicli","purl":null,"source":"GHSA-v3f4-w7r7-v3hm"},{"ecosystem":"npm","fixed":["0.225.2"],"introduced":["0"],"last_affected":[],"package":"@zenalexa/unicli","purl":"pkg:npm/%40zenalexa/unicli","source":"GHSA-v3f4-w7r7-v3hm"}],"prev":{"headline":"ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API","id":"CVE-2026-58496"},"products":["Uni-CLI"],"published":"2026-10-23","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-23","vendors":["olo-dot-io"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-58497/"}