UI-TARS-desktop MCP Server: Critical Unauthenticated RCE

What it is

CVE-2026-81735 (published 2026-08-27) is a CVSSv3 10.0 unauthenticated RCE in the mcp-http-server package shipped with UI-TARS-desktop. The existing summary covers the mechanism; the page adds the pieces needed to actually check and remediate an instance: the affected package version, the vulnerable function name, and the two mitigation paths short of upgrading.

Preconditions / Affected

• Package version 1.2.4 is where this lives — and the fix landed without a version bump, so 1.2.4 exists in both vulnerable and patched forms. Version number alone tells you nothing; you must check whether the build includes commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168.
• Vulnerable code is in startServer.ts, specifically startSseAndStreamableHttpMcpServer. When no host is passed it defaults to '::', binding every interface.
• The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call that function with only host and port and no auth middleware (middleware is applied only when explicitly supplied).
• Exposure requires network reachability to the listening port; a firewall or explicit host binding removes it.

What to do

Three options, in order of preference:

1. Update to a build containing commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 (default listen address changed to 127.0.0.1). Do not trust the 1.2.4 version string as proof either way.
2. If you can't update, explicitly pass the host to startSseAndStreamableHttpMcpServer — set it to 127.0.0.1 or a specific internal IP so the transport stops binding '::'.
3. Add network-level access controls on the service port as defense-in-depth.

Caveats

No public PoC exists as of the page's writing. The page does not specify the exact injection point for the command string in run_command, only that it flows into promisify(child_process.exec), so standard shell-injection technique is inferred rather than demonstrated. The workaround in option 2 addresses exposure (binding scope), not the underlying lack of authentication — an attacker with access to the bound interface still faces no credential check.