python-utcp CVE-2025-14542

Exploitation requires the UTCP client to fetch its tool Manual from an attacker-controlled or later-compromised remote Manual Endpoint that the operator has configured and trusts, and it leverages protocol escalation - a manual served over one protocol (e.g. HTTP) registering CLI-protocol tools that execute OS commands via the CLI plugin. Limiting factors that reduce realistic risk: the victim must first trust the provider and then invoke the swapped tool (UI:R), the trust-then-switch sequence raises attack complexity (AC:H), and the behavior is neutralized in fixed builds where allowed_communication_protocols defaults to the manual's own protocol type, filtering out and rejecting foreign-protocol tools at both registration and call time. Clients that only consume their own or fully trusted first-party manual endpoints are not practically exposed.

Scored CVSS 7.5 (HIGH) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The network attack vector and lack of required privileges (PR:N) sound alarming, but two metrics materially reduce real-world risk: AC:H reflects the multi-stage time-of-check/time-of-use trust abuse (the provider must first earn trust with a benign manual, then swap in a malicious one), and UI:R means the victim client must actually fetch and invoke the tampered tool. No EPSS score, no CISA KEV entry, and no public POC are present in the provided data, so by the precision rules this is 'no public exploit identified at time of analysis' - not active exploitation. The input Tag labels this 'Information Disclosure,' but the JFrog advisory title (python-utcp-untrusted-manual-command-execution) and the fix - which adds protocol restrictions to stop an HTTP manual from invoking CLI tools - make clear the true impact is arbitrary OS command execution on the client host, consistent with C:H/I:H/A:H and CWE-501 (Trust Boundary Violation). Net assessment: a genuine design-level flaw for anyone consuming third-party/untrusted UTCP manual endpoints, but practical exploitation is gated on the victim trusting a malicious or compromised provider rather than being a mass-exploitable remote bug. CONFLICT TO NOTE: the 'Information Disclosure' tag understates and mischaracterizes the command-execution impact documented by the vendor.

A developer configures a UTCP client to consume a remote Manual Endpoint from a third-party provider, which initially serves a benign HTTP tool manual and earns the client's trust. The provider (or an attacker who later compromises it) swaps the manual for one that registers CLI-protocol tools; when the client fetches and invokes a tool, attacker-chosen OS commands execute on the client host via protocol escalation. No public exploit code is identified at time of analysis, though the JFrog research advisory documents the technique in detail.