olo-dot-io CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH olo-dot-io CVE published 2026-06-19

CVE-2026-58497

CVE-2026-58497 debrief: Uni-CLI's legacy HTTP MCP transport accepted browser-originated localhost requests before version 0.225.2. This issue allowed malicious web pages to send CORS simple POST requests to the local /mcp endpoint, potentially driving tools/call requests against the user's local Uni-CLI server if the local MCP HTTP transport was started. The vulnerability was patched in version 0.225.2 by [truncated]