A flaw in python-utcp causes user-supplied tool_args to be concatenated directly into shell command strings that are later executed via /bin/bash or powershell.exe. This unsanitized insertion permits an attacker to inject arbitrary shell commands, effectively gaining remote command execution on the host where the protocol runs. The weakness is classified as CWE-78, reflecting command injection vulnerabilities. The CVSS score of 8.3 indicates a high severity risk when exploitable.

The vulnerability exists in the universal-tool-calling-protocol python-utcp package for all releases older than 1.1.3. The fix was introduced in version 1.1.3, removing the unsafe argument substitution mechanism.

With a CVSS rating of 8.3, the risk is high, but no EPSS data is currently available, and the flaw is not listed in CISA’s KEV catalog. Attackers must be able to influence the tool_args parameter, which is typically exposed to users of the CLI protocol. When an attacker can control that input, they can execute arbitrary commands in the environment where python-utcp runs, potentially compromising confidentiality, integrity, and availability of the system.