{"metadata": {"vulnerability": "CVE-2026-58497", "count": 12, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-06-19T21:43:09Z", "date_only": false, "value": "2026-06-19T21:43:09Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-V3F4-W7R7-V3HM", "record": "GHSA-V3F4-W7R7-V3HM", "field": "published"}, {"timestamp": "2026-06-19T21:43:09Z", "date_only": false, "value": "2026-06-19T21:43:09Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-V3F4-W7R7-V3HM", "record": "GHSA-V3F4-W7R7-V3HM", "field": "modified"}, {"timestamp": "2026-06-30T20:21:25.813Z", "date_only": false, "value": "2026-06-30T20:21:25.813Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-58497", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T14:49:42.619Z", "date_only": false, "value": "2026-10-23T14:49:42.619Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58497", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T14:49:42.619Z", "date_only": false, "value": "2026-10-23T14:49:42.619Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-58497", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T15:17:34.257Z", "date_only": false, "value": "2026-10-23T15:17:34.257", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58497", "record": "FKIE_CVE-2026-58497", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T15:34:26.683Z", "date_only": false, "value": "2026-10-23T15:34:26.683533Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490952832625949", "record": "CVE-2026-58497", "field": "creation_timestamp", "uuid": "dae455a4-0390-4e49-a898-c2189867d401", "content": "CVE-2026-58497 Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.\nhttps://www.cve.org/CVERecord?id=CVE-2026-58497https://github.com/olo-dot-io/Uni-CLI/security/advisories/GHSA-v3f4-w7r7-v3hmhttps://github.com/olo-dot-io/Uni-CLI/releases/tag/v0.225.2#olo-dot-io #Uni-CLI#CVE_2026_58497#bot", "url": "https://infosec.exchange/users/cve/statuses/117490952832625949"}, {"timestamp": "2026-10-23T20:54:34.404Z", "date_only": false, "value": "2026-10-23T20:54:34.404803Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-58497", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-23T20:54:34.404Z", "date_only": false, "value": "2026-10-23T20:54:34.404803Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58497", "record": "FKIE_CVE-2026-58497", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-23T20:57:14.612Z", "date_only": false, "value": "2026-10-23T20:57:14.612Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-58497", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T20:57:14.612Z", "date_only": false, "value": "2026-10-23T20:57:14.612Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-58497", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T21:17:24.620Z", "date_only": false, "value": "2026-10-23T21:17:24.620", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58497", "record": "FKIE_CVE-2026-58497", "field": "lastModified"}], "metrics": {"as_of": "2026-10-31T23:21:19.279Z", "anchors": {"origin": {"timestamp": "2026-10-23T14:49:42.619Z", "date_only": false, "value": "2026-10-23T14:49:42.619Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58497", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T14:49:42.619Z", "date_only": false, "value": "2026-10-23T14:49:42.619Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58497", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 721896.660994, "hours": 200.52685027611113, "days": 8.355285428171296, "min_seconds": 721896.660994, "max_seconds": 721896.660994, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T14:49:42.619Z", "date_only": false, "value": "2026-10-23T14:49:42.619Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58497", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T23:21:19.279Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}