CVE-2026-45369

HIGH

python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

Title source: cna
STIX 2.1

Description

python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3.

References (1)

Core 1

Scores

CVSS v3 8.3
EPSS 0.0001
EPSS Percentile 3.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (2)
pypi/utcp-cli 0 - 1.1.2PyPI
universal-tool-calling-protocol/python-utcp < 1.1.2
Published May 14, 2026
Tracked Since May 15, 2026