Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
prepareenvironment() in clicommunicationprotocol.py passes a full copy of os.environ to every CLI subprocess. When combined with the Command Injection vulnerability (CWE-78) in substituteutcpargs() tracked as GHSA-33p6-5jxp-p3x4, an attacker can exfiltrate all process-level secrets in a single tool call. Vulnerable Code Impact Any environment variable present in the host process is accessible to injected commands. In typical AI agent deployments this includes: - Cloud provider credentials (AWSSECRETACCESSKEY, AZURECLIENTSECRET) - Database connection strings (DATABASEURL) - LLM API keys (OPENAIAPIKEY, ANTHROPICAPIKEY) - Internal service tokens Proof of Concept Patched Fixed in utcp-cli 1.1.2. prepareenvironment no longer copies the full host environment. Inheritance is controlled by a new CliCallTemplate.inheritenvvars field: - null (default): a small built-in OS-specific allowlist (PATH, HOME, LANG on Unix; PATH, PATHEXT, SYSTEMROOT, USERPROFILE, etc. on Windows) is inherited…
Recommended action: Upgrade to 1.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The substituteutcpargs method in clicommunicationprotocol.py inserts user-controlled toolargs values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands. Affected File plugins/communicationprotocols/cli/src/utcpcli/clicommunicationprotocol.py Vulnerable Code The substituted command is then embedded directly into a shell script: And executed via: Proof of Concept Given a tool defined as: Calling with: Produces and executes: This results in full Remote Code Execution on the host system. Patched Fixed in utcp-cli 1.1.2. substituteutcpargs now shell-quotes every substituted value: shlex.quote on Unix, a PowerShell single-quoted literal on Windows. Each UTCPARG...UTCPEND placeholder therefore expands to exactly one shell token, blocking metacharacter injection (;, |, &, backticks, $(), newlines). Behavior…
Recommended action: Upgrade to 1.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.