CVE-2025-14542
High · 7.5CVSS
7.5
EPSS
0.3%
Published
Dec 13, 2025
CISA due date
—
The record
The vulnerability arises when a client fetches a tools’ JSON specification, known as a Manual, from a remote Manual Endpoint. While a provider may initially serve a benign manual (e.g., one defining an HTTP tool call), earning the clients’ trust, a malicious provider can later change the manual to exploit the client.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | utcp | 0 | 1.1.0 |
Related vulnerabilities
- CVE-2026-65902 DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the… CWE-501
- GHSA-76mc-f452-cxcm DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently… CWE-501
- GHSA-hpcv-96wg-7vj8 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via… CWE-501
- CVE-2026-33828 Trust boundary violation in Windows Attestation allows an authorized attacker to elevate… CWE-501
- GHSA-f26g-jm89-4g65 gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update()… CWE-501
- GHSA-jf56-mccx-5f3f OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the… CWE-501
- GHSA-gfmx-pph7-g46x OpenClaw: Lower-trust background runtime output is injected into trusted `System:`… CWE-501
- CVE-2026-24153 NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application… CWE-501