PT-2025-51111 · Git+1 · Python-Utcp+1

Published 2025-12-13 · Updated 2025-12-18 · CVE-2025-14542

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions (affected versions not specified)

Description The issue occurs when a client retrieves a tools’ JSON specification, referred to as a Manual, from a remote Manual Endpoint. A provider can initially deliver a harmless manual, establishing client trust, but subsequently alter the manual to exploit the client. This allows a malicious provider to change the manual after the client has begun to trust the provider.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-501

Related Identifiers

CVE-2025-14542

GHSA-75MJ-4G74-9RG2

Affected Products

Python-Utcp

Utcp

References · 9

• https://github.com/universal-tool-calling-protocol/python-utcp/commit/2dc9c02df72cad3770c934959325ec344b441444 · Patch
• https://osv.dev/vulnerability/CVE-2025-14542 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14542 · Security Note
• https://osv.dev/vulnerability/GHSA-75mj-4g74-9rg2 · Vendor Advisory
• https://github.com/universal-tool-calling-protocol/python-utcp · Note
• https://twitter.com/cracbot/status/2001608437793460523 · Twitter Post
• https://research.jfrog.com/vulnerabilities/python-utcp-untrusted-manual-command-execution-jfsa-2025-001648329 · Note
• https://twitter.com/CVEnew/status/1999865314683830736 · Twitter Post
• https://t.me/CVEtracker/39723 · Telegram Post