CVE-2026-81735

Name of the Vulnerable Software and Affected Versions UI-TARS-desktop mcp-http-server version 1.2.4 (prior to commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168)

Description The startServer.ts file in the mcp-http-server package defaults the listen address to :: when no host is provided. This causes the startSseAndStreamableHttpMcpServer function to bind Streamable HTTP and SSE MCP transports to every network interface. Because authentication middleware is optional and not supplied by the @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points, these servers do not require credentials. Consequently, an unauthenticated client can access the run command tool, which passes input to promisify(child process.exec), allowing arbitrary command execution as the user running the server. Similarly, the filesystem server exposes file read and write tools to unauthenticated users.

Recommendations Update the mcp-http-server package to the version containing commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 to ensure the listen address defaults to 127.0.0.1.