CVE-2026-45369CWE-78

python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

High · published May 14, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
27.7
In the wild
Unconfirmed
What it is

python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00352 · 27.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-05-14T20:14Z
EPSS history
Timeline
  • 14 MAY 20:14Z
    python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol
    cvelistv5