universal-tool-calling-protocol/python-utcp Security Advisories | GitStock

high2026-08-25

utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion

GHSA-8cp3-qxj6-px34

medium2026-08-25

utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins

GHSA-ppx3-28rw-8fpf · CVE-2026-12210

high2026-08-25

utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target

GHSA-9qhg-99ww-9mqc

high2026-05-14

python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

GHSA-5v57-8rxj-3p2r · CVE-2026-45370

critical2026-05-14

utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

GHSA-33p6-5jxp-p3x4 · CVE-2026-45369

medium2026-05-07

utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

GHSA-39j6-4867-gg4w · CVE-2026-44661

high2025-12-13

Universal Tool Calling Protocol (UTCP) client library for Python vulnerable to Trust Boundary Violation through Manual JSON specification

GHSA-75mj-4g74-9rg2 · CVE-2025-14542