olo-dot-io Uni-CLI vulnerabilities

Latest olo-dot-io Uni-CLI CVEs

Newest publication first

1. CVE-2026-58497 Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

   Published 2026-10-23

   High·CVSS 8.6 EPSS 0.26%

   Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing req...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.