Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

Description

Uni-CLI versions before 0.225.2 exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher.

Recommendation

Update the @zenalexa/unicli package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.225.2
• Patched version(s): 0.225.2

References

• GHSA-v3f4-w7r7-v3hm
• CWE-346
• CWE-352
• OWASP 2021-A1
• OWASP 2021-A7