AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-5v57-8rxj-3p2r: python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

highvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseMay 14, 2026CVE-2026-45370

Summary

A vulnerability in the python-utcp library exposed all environment variables (including secrets like API keys and database passwords) to subprocesses because the `_prepare_environment()` function copied the entire host environment. When combined with a command injection flaw (CWE-78, where an attacker can sneak malicious commands into tool arguments), an attacker could steal sensitive credentials like AWS keys, database connection strings, and LLM API keys in a single tool call.

Solution / Mitigation

Upgrade to utcp-cli version 1.1.2 or later. The patch changes `_prepare_environment()` to use a controlled allowlist of environment variables instead of copying everything. Users can configure which variables are inherited via a new `CliCallTemplate.inherit_env_vars` field: set it to `null` (default, uses a safe OS-specific allowlist like PATH and HOME), `[]` (strict mode, nothing inherited), or specify exact variable names like `["FOO", "BAR"]`. Sensitive variables like `OPENAI_API_KEY` no longer reach subprocesses unless explicitly allowed.