Attack Chain

1. An attacker crafts a malicious payload containing shell metacharacters.
2. The attacker supplies this payload as a value within the tool_args dictionary.
3. The vulnerable _substitute_utcp_args method substitutes the attacker-controlled value into a command string.
4. Due to the lack of sanitization, the command string now contains the injected shell metacharacters.
5. The command string is embedded within a shell script.
6. The shell script is executed using /bin/bash -c or powershell.exe -Command.
7. The injected shell metacharacters are interpreted, executing arbitrary commands.
8. The attacker achieves Remote Code Execution on the host system.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the host system with the privileges of the utcp-cli application. This can lead to complete system compromise, including data exfiltration, malware installation, and denial-of-service. Given the severity and ease of exploitation, any system running a vulnerable version of utcp-cli is at critical risk.

Recommendation

• Upgrade utcp-cli to version 1.1.2 or later to remediate CVE-2026-45369.
• Deploy the Sigma rule “Detect utcp-cli Command Injection Attempt via Argument Substitution” to your SIEM and tune for your environment.
• If upgrading is not immediately feasible, restrict or audit user-supplied input to tool_args to mitigate the risk of command injection.