Skip to content
Threat Feed

Product

Utcp-Cli

1 brief RSS
critical threat

utcp-cli Command Injection Vulnerability via Unsanitized Argument Substitution (CVE-2026-45369)

The `utcp-cli` package is vulnerable to command injection. The `_substitute_utcp_args` method in `cli_communication_protocol.py` inserts user-controlled values directly into shell command strings without sanitization, allowing an attacker to inject arbitrary shell commands, resulting in full Remote Code Execution. The vulnerability is fixed in version 1.1.2.

utcp-cli command-injection rce
2r 1t