What is the CVSS score of CVE-2026-45369?

CVE-2026-45369 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of python-utcp are affected by CVE-2026-45369?

python-utcp versions prior to 1.1.2 contain a command injection vulnerability in CLI argument processing that allows remote attackers to execute arbitrary commands on both Unix and Windows systems.. A patch is available.

Is there a public PoC exploit available for CVE-2026-45369?

Yes, a public proof-of-concept exploit is available for CVE-2026-45369. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-45369?

Within 24 hours: Identify all systems and applications using python-utcp and document current versions in use. Within 7 days: Upgrade python-utcp to version 1.1.2 or later across all affected systems; prioritize production and internet-facing deployments. Within 30 days: Conduct code review of any custom integrations using python-utcp CLI communication to validate that user-supplied arguments are no longer processed as shell commands after patching.

python-utcp CVE-2026-45369

EUVD-2026-30475 HIGH

OS Command Injection (CWE-78)

2026-05-14 security-advisories@github.com

GHSA-33p6-5jxp-p3x4

Python Microsoft Command Injection

8.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 14, 2026 - 22:05 vuln.today

Analysis Generated

May 14, 2026 - 22:05 vuln.today

Patch available

May 14, 2026 - 22:02 EUVD

CVE Published

May 14, 2026 - 21:16 nvd

HIGH 8.3

DescriptionGitHub Advisory

python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3.

AnalysisAI

Command injection in python-utcp allows remote attackers to execute arbitrary shell commands on Unix and Windows systems when user-controlled tool arguments are processed by the CLI communication protocol module. The _substitute_utcp_args method in cli_communication_protocol.py directly embeds unsanitized user input into bash or PowerShell commands without escaping, enabling full remote code execution. Vendor-released patch available in version 1.1.2 with shell-quoting mitigation (shlex.quote on Unix, single-quoted literals on Windows). CVSS 8.3 indicates high complexity and required user interaction, but scope change enables container/sandbox escape scenarios. No public exploit code or CISA KEV listing identified at time of analysis, though detailed proof-of-concept exists in the GitHub security advisory demonstrating data exfiltration via curl.

Technical ContextAI

Python-utcp is a Python implementation of the Universal Tool Calling Protocol, providing a CLI communication interface for executing external tools with parameterized arguments. The vulnerability resides in the cli_communication_protocol.py module's _substitute_utcp_args method, which performs string interpolation of UTCP_ARG_..._UTCP_END placeholders within shell command templates. The affected code path invokes /bin/bash -c on Unix systems and powershell.exe -Command on Windows to execute dynamically constructed scripts containing user-supplied values. This represents a classic CWE-78 OS Command Injection flaw where metacharacters (semicolons, pipes, backticks, command substitution operators) in tool_args parameters are interpreted as shell syntax rather than literal data. The CPE pip/utcp-cli indicates this is a PyPI-distributed package affecting versions through 1.1.1. The fix in 1.1.2 applies language-appropriate quoting primitives (Python's shlex.quote for POSIX shells, custom PowerShell single-quote escaping for Windows) to ensure each placeholder expands to exactly one shell token, preventing metacharacter interpretation.

RemediationAI

Upgrade to utcp-cli version 1.1.2 or later immediately, available via PyPI (pip install --upgrade utcp-cli). The patched version applies shell-quoting to all UTCP_ARG placeholder substitutions using shlex.quote on Unix and PowerShell-safe single-quote literals on Windows, ensuring each placeholder expands to exactly one shell token. Critical behavioral change: tool definitions that previously relied on a single placeholder expanding to multiple shell tokens (e.g., UTCP_ARG_flags_UTCP_END expanding to --verbose --debug) must be refactored to use one placeholder per intended argument. Organizations should audit existing tool definitions and update them accordingly during upgrade testing. No workaround exists for versions prior to 1.1.2 other than completely rejecting all user-controlled tool_args inputs at the application boundary, which may not be feasible for legitimate use cases. For environments where immediate upgrade is blocked by the behavioral change, implement application-layer input validation to reject tool_args containing shell metacharacters (semicolons, pipes, backticks, dollar signs, newlines, ampersands), though this defense-in-depth measure is fragile and should only be temporary until proper upgrade. Review server logs for suspicious tool_args patterns that may indicate reconnaissance or exploitation attempts. Detailed patch implementation and migration guidance available in the GitHub advisory at the reference link above.