CVE-2026-45370 | THREATINT

Description

python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call. This vulnerability is fixed in 1.1.3.

PUBLISHED Reserved 2026-05-12 | Published 2026-05-14 | Updated 2026-05-15 | Assigner GitHub_M

HIGH: 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Problem types

CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable

Product status

< 1.1.2

affected

References

github.com/...n-utcp/security/advisories/GHSA-5v57-8rxj-3p2r exploit

github.com/...n-utcp/security/advisories/GHSA-5v57-8rxj-3p2r

cve.org (CVE-2026-45370)

nvd.nist.gov (CVE-2026-45370)

Download JSON