HighVulnerability
GHSA-5v57-8rxj-3p2r: python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection
- Identifiers
- CVE-2026-45370GHSA-5v57-8rxj-3p2r
- Published
- Record updated
- Affected
- utcp-cli <= 1.1.1
- Fixed in
- 1.1.2
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
python-utcp's `_prepare_environment()` in `cli_communication_protocol.py` passes a full copy of `os.environ` to every CLI subprocess. Combined with the Command Injection flaw in `_substitute_utcp_args()` (GHSA-33p6-5jxp-p3x4), an attacker can exfiltrate all process-level secrets, including cloud credentials, database strings and LLM API keys, in a single tool call. The issue is fixed in `utcp-cli` 1.1.2, which adds a `CliCallTemplate.inherit_env_vars` field to control inheritance.
Mitigation
Upgrade to `utcp-cli >= 1.1.2`. There is no workaround in earlier versions short of stripping secrets from the host process before any CLI tool call.
Related items
- MediumCVE-2026-109296: Open WebUI missing authorization lets users reach disabled model backendsSame vendor · NVD/CVE Database
- MediumCVE-2026-107430: VideoWhisper Site Manager for ChatGPT, Claude, Codex missing authorization checkSame vendor · NVD/CVE Database
- HighCVE-2026-101998: Docker Sandboxes fail open when masking credentials in proxy responsesSame vendor · NVD/CVE Database
- HighCVE-2026-103435: Claude Code symlink race condition allows writes outside project directorySame vendor · NVD/CVE Database
- HighGHSA-6qxp-vccf-f47h: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverSame vendor · GitHub Advisory Database