Skip to content
OpenAdvisories

Package · PyPI

utcp-cli

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.3
    CVE-2026-45369

    python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

    python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These comman…

    universal-tool-calling-protocol python-utcp utcp-cli PyPI
  • High 7.7
    CVE-2026-45370

    python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

    python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level…

    universal-tool-calling-protocol python-utcp utcp-cli PyPI