Command Injection Vulnerability in Python UTCP by Universal Tool Calling Protocol

CVE-2026-45369

What is CVE-2026-45369?

The python-utcp implementation contains a command injection vulnerability due to the insecure handling of user-controlled arguments in the _substitute_utcp_args method. These arguments are directly incorporated into shell command strings, enabling an attacker to execute arbitrary commands on the underlying system via /bin/bash -c on Unix or powershell.exe -Command on Windows. Users are highly encouraged to upgrade to version 1.1.3 or later to mitigate this significant security risk.

References