CVE-2026-81735 affects the mcp-http-server package in UI-TARS-desktop, where startServer.ts defaulted its listen address to '::' (all interfaces) when no host was specified. The authentication middleware was optional and never passed by the @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points, leaving both servers completely unauthenticated. The commands server exposed a run_command tool that directly passed caller-supplied strings to child_process.exec, enabling unauthenticated remote code execution as the server process user. The filesystem server similarly exposed unrestricted file read and write capabilities. The fix changed the default listen address to 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168, but the package version remained at 1.2.4, making the commit the remediation boundary rather than a versioned release. Any network-accessible attacker could exploit this to fully compromise the host system.
