Product
The mcp-http-server package in UI-TARS-desktop exposes unauthenticated MCP transports globally, allowing remote attackers to execute arbitrary system commands and access the filesystem.