# CVE-2026-45369: python-utcp OS command injection in CLI communication protocol

Source: https://junglewise.ai/threats/cve-2026-45369-python-utcp-os-command-injection-in-cli-communication-protocol  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-45369 · Severity: critical · CVSS 10 · Published 2026-05-14

python-utcp is a library used to implement the Universal Tool Calling Protocol, which allows software to interact with various command-line tools. A security flaw in how the library handles user-provided arguments allows an attacker to execute unauthorized commands on the underlying operating system. This could lead to a complete system takeover, data theft, or service disruption if the library processes untrusted input.

Technologies: [Universal Tool Calling Protocol Python-Utcp](https://junglewise.ai/threats/technologies/python-utcp). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Universal Tool Calling Protocol](https://junglewise.ai/threats/vendors/universal-tool-calling-protocol).

## Quick answers

**Is CVE-2026-45369 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45369 being exploited in the wild.

**How severe is CVE-2026-45369?** Critical severity, with a CVSS score of 10, published 14 May 2026.

**Which products and versions are affected?** utcp-cli (PyPI) <= 1.1.1, ECOSYSTEM:introduced=0,fixed=1.1.2; Universal Tool Calling Protocol Python-Utcp < 1.1.2.

**Is there a fix for CVE-2026-45369?** Yes. utcp-cli (PyPI): upgrade to 1.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45369 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45369?** Check whether you run utcp-cli (PyPI) or Universal Tool Calling Protocol Python-Utcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- utcp-cli (PyPI): upgrade to 1.1.2 or later

  ```sh
  pip install "utcp-cli>=1.1.2"
  ```


## Technical details

An OS command injection vulnerability exists in the `_substitute_utcp_args` method within `cli_communication_protocol.py` of the python-utcp library. The component fails to sanitize or escape user-controlled `tool_args` before inserting them into shell command strings, which are subsequently executed via `/bin/bash -c` on Unix or `powershell.exe -Command` on Windows. An attacker can exploit this by supplying arguments containing shell metacharacters (e.g., semicolons, pipes, or backticks) to achieve arbitrary code execution. The vulnerability is triggered when the library processes a tool call with malicious arguments, typically requiring some level of user interaction or a specific application flow. This issue is resolved in version 1.1.2 by implementing proper shell-quoting using `shlex.quote` and PowerShell-specific escaping.

## Affected products

- universal-tool-calling-protocol python-utcp (utcp-cli) < 1.1.2

## Identifiers

- CVE-2026-45369
- GHSA-33p6-5jxp-p3x4
- PYSEC-2026-560

## Timeline

- 2026-05-10: advisory: GitHub Security Advisory published
- 2026-05-14: disclosed: CVE-2026-45369 published to NVD

## References

- [https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-33p6-5jxp-p3x4](https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-33p6-5jxp-p3x4)

## Related threats

- [python-utcp server-side request forgery via unvalidated HTTP redirects](https://junglewise.ai/threats/cve-2026-101060-python-utcp-versions-before-1-1-4-contain-a-server-side-request)
- [python-utcp server-side request forgery via remote HTTP manual](https://junglewise.ai/threats/cve-2026-101058-python-utcp-pip-package-utcp-http-before-1-1-12-does-not-verify)
- [python-utcp localhost prefix validation bypass in utcp-gql and utcp-websocket](https://junglewise.ai/threats/python-utcp-localhost-prefix-validation-bypass-in-utcp-gql-and-utcp-cca0bdf1)
- [Universal Tool Calling Protocol SSRF via localhost validation bypass](https://junglewise.ai/threats/cve-2026-12210-universal-tool-calling-protocol-ssrf-via-localhost-validation)
- [python-utcp sensitive information exposure via environment variables](https://junglewise.ai/threats/cve-2026-45370-python-utcp-sensitive-information-exposure-via-environment)