PT-2026-41124 · Pypi · Python-Utcp

Zeroxjacks · Published 2026-05-14 · Updated 2026-05-15 · CVE-2026-45370

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions python-utcp versions prior to 1.1.3

Description The prepare environment() function in cli communication protocol.py passes a complete copy of os.environ to every CLI subprocess. This allows any environment variable in the host process, such as cloud provider credentials, database connection strings, and LLM API keys, to be accessible to injected commands. When combined with a command injection flaw in the substitute utcp args() function, an attacker can exfiltrate all process-level secrets in a single tool call.

Recommendations Update to version 1.1.3 or newer.

Exploit

Fix

Weakness Enumeration

CWE-526

Related Identifiers

CVE-2026-45370

GHSA-5V57-8RXJ-3P2R

Affected Products

Python-Utcp

References · 7

• 🔥 https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-5v57-8rxj-3p2r · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45370 · Security Note
• https://osv.dev/vulnerability/GHSA-5v57-8rxj-3p2r · Vendor Advisory
• https://github.com/universal-tool-calling-protocol/python-utcp · Note
• https://twitter.com/CVEnew/status/2055074235341545477 · Twitter Post
• https://t.me/cveNotify/163603 · Telegram Post
• https://t.me/CVEtracker/53845 · Telegram Post