Executive brief
A vulnerability in the python-utcp library, used for AI agent tool calling, allows sensitive system information to be leaked. When an attacker uses a command injection flaw, the library inadvertently shares all of the host's environment variables with the malicious process. This can result in the theft of critical secrets such as cloud credentials, database passwords, and AI service API keys.
Technical details
The `_prepare_environment()` function in `cli_communication_protocol.py` uses `os.environ.copy()` to pass the entire host environment to every CLI subprocess. When combined with a separate command injection vulnerability (CWE-78) in argument substitution, an attacker can execute arbitrary commands that have access to all process-level environment variables. This typically includes sensitive credentials like AWS keys, database URLs, and LLM API keys. The vulnerability is fixed in version 1.1.2 by implementing a restricted allowlist for environment variable inheritance.
Affected products
- universal-tool-calling-protocol utcp-cli <= 1.1.1
Timeline
- 2026-05-10: disclosed
- 2026-05-14: advisory
- 2026-05-14: patched: Fixed in utcp-cli 1.1.2