Threats affecting pkg:github/gojue/moling

CVE-2026-62863 affects the gojue moling MCP server prior to version 0.5.0. When running in SSE mode with the `-l` option, the server's `/sse` and `/message` HTTP endpoints do not authenticate requests, and the mcp-go dependency sets a permissive CORS policy allowing all origins. This allows a malicious web page to open a cross-origin EventSource to `/sse` and read sensitive sessionId information. An attacker can then use the stolen sessionId to send unauthorized MCP tool calls to `/message`, potentially reading or writing local files, executing commands, or performing other actions. The issue is fixed in version 0.5.0.