Description

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are applied only when a caller supplies them. The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call startSseAndStreamableHttpMcpServer with a host and port alone and pass no middleware, so neither server required a credential. The commands server exposes a run_command tool that hands its caller-supplied command string to promisify(child_process.exec), so any unauthenticated client able to reach the port could run arbitrary commands as the user running the server, and the filesystem server exposed its file read and write tools on the same terms. The listen default became 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168; the package version stayed at 1.2.4 across that change, so the boundary is the commit rather than a release.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-27T17:21:03.677Z",
  "pubdate": "2026-08-27T17:21:03.677Z",
  "executiveSummary": "The mcp-http-server package in UI-TARS-desktop contains a critical security vulnerability arising from insecure default network binding and optional authentication middleware implementation. The server improperly defaulted its listen address to '::' (all interfaces), exposing MCP transports publicly. Concurrently, the architecture treats authentication as an optional component that is not enforced by default in the @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points.\nThis combination allows unauthenticated network-adjacent attackers to interact directly with sensitive MCP tools. Specifically, the 'run_command' tool provided by the commands server facilitates arbitrary command execution via child_process.exec, while the filesystem server grants unauthorized file system access. The vulnerability poses a severe risk of full system compromise, as it permits remote code execution with the privileges of the user running the server process. Successful exploitation requires no authentication and only network reachability to the server's listening port. This issue was remediated by changing the default binding address to 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168, restricting access to the local loopback interface.",
  "technicalDetails": "The vulnerability resides within the startServer.ts implementation of the mcp-http-server package. The root cause is twofold: insecure network socket binding and an opt-in authentication design pattern. Initially, the startSseAndStreamableHttpMcpServer function defaulted its host parameter to '::', which instructs the underlying node.js HTTP server to listen on all available network interfaces, including external public interfaces, rather than strictly the local loopback (127.0.0.1).\nAuthentication in this architecture is managed via optional middleware. The server implementation does not enforce authentication by default; instead, it relies on the caller (the entry point) to explicitly supply middleware. The entry points @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem initiate the server with only host and port parameters, effectively resulting in a server instance that requires no credentials for incoming requests. Consequently, any client capable of reaching the designated TCP port can access all exposed MCP tools.\nThe attack flow follows a predictable pattern: 1) The attacker performs network reconnaissance to identify the server port on an exposed interface. 2) The attacker sends unauthenticated HTTP requests to the SSE or HTTP MCP transport endpoints. 3) For the @agent-infra/mcp-server-commands service, the attacker invokes the 'run_command' tool, passing a crafted string as an argument. 4) The application processes this input by passing it directly to promisify(child_process.exec), a function known to be vulnerable to command injection if input is not strictly sanitized. 5) The host system executes the command with the permissions of the application process. 6) Similar access is achieved in the filesystem service, where read/write tools are exposed without verification, allowing for arbitrary file modification or exfiltration.\nThis vulnerability is particularly severe because the use of child_process.exec interprets the input string as a shell command, facilitating command injection. Post-exploitation, an attacker gains the ability to execute arbitrary code, escalate privileges if the server process is over-privileged, or pivot further into the internal network. The vulnerability impacts all deployments using versions up to the fix applied in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168. By forcing the bind address to 127.0.0.1, the attack surface is restricted to the local machine, preventing external remote exploitation."
}