AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests? What should I do?

    Uni-CLI versions before 0.225.2 exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests.

    Affected: Uni-CLI versions before 0.225.2. Fixed in: 0.225.2. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/06/ghsa-v3f4-w7r7-v3hm-uni-cli (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: Uni-CLI versions before 0.225.2. Fixed in: 0.225.2.

      • Check your version: run npm ls @zenalexa/unicli. Versions < 0.225.2 of @zenalexa/unicli are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install @zenalexa/unicli@0.225.2 (first patched version 0.225.2).
      2. Upgrade to 0.225.2 or later.
      3. If upgrading is not immediately possible, do not expose the legacy HTTP MCP transport to browser-originated traffic; use the default stdio transport or the Streamable HTTP transport instead.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/06/ghsa-v3f4-w7r7-v3hm-uni-cli (opens external site)

      Did this work for you?

    Add your answer or comment