Executive brief
python-utcp is a library used to implement the Universal Tool Calling Protocol, which allows software to interact with various command-line tools. A security flaw in how the library handles user-provided arguments allows an attacker to execute unauthorized commands on the underlying operating system. This could lead to a complete system takeover, data theft, or service disruption if the library processes untrusted input.
Technical details
An OS command injection vulnerability exists in the `_substitute_utcp_args` method within `cli_communication_protocol.py` of the python-utcp library. The component fails to sanitize or escape user-controlled `tool_args` before inserting them into shell command strings, which are subsequently executed via `/bin/bash -c` on Unix or `powershell.exe -Command` on Windows. An attacker can exploit this by supplying arguments containing shell metacharacters (e.g., semicolons, pipes, or backticks) to achieve arbitrary code execution. The vulnerability is triggered when the library processes a tool call with malicious arguments, typically requiring some level of user interaction or a specific application flow. This issue is resolved in version 1.1.2 by implementing proper shell-quoting using `shlex.quote` and PowerShell-specific escaping.
Affected products
- universal-tool-calling-protocol python-utcp (utcp-cli) < 1.1.2
Timeline
- 2026-05-10: advisory: GitHub Security Advisory published
- 2026-05-14: disclosed: CVE-2026-45369 published to NVD