CVE-2026-45370: Environment Variable Leak in python-utcp CLI Subprocesses Vulnerability ID: CVE-2026-45370 CVSS Score: 7.7 Published: 2026-05-14 The python-utcp library improperly exposes the host application's full environment variables to spawned subprocesses via os.environ.copy(). When combined with an existing command injection flaw, attackers can exfiltrate all host secrets in a single request. TL;DR python-utcp prior to version 1.1.3 improperly exposes process-level environment variables to CLI subprocesses, enabling secret exfiltration when chained with command injection vulnerabilities.…