Vulnerabilities CVE-2026-45369

CVE-2026-45369

High

Open

TLP:CLEAR

python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3.

Details

CVSS Score: 8.3
EPSS Score ⓘ: 0.27%

19.4th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Confidence: 90%
Published: May 14, 2026
Last Modified: May 14, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.