Vulnerability · Published Aug 27, 2026 · Assigned by VulnCheck
CVE-2026-81096ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape
Critical 10.0
In plain English
A critical-severity code injection in ToolUniverse from mims-harvard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Official description
ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal's class to its base and enumerate subclasses to obtain a reference to the process and subprocess modules. A per-call argument also let the caller widen the import allow-list before the inspection ran. The HTTP and MCP servers in http_api_server.py and smcp_server.py bound to every interface with debugging enabled and no authentication, so any caller able to reach the port executed code as the server process. Version 1.3.0 adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mims-harvard | ToolUniverse | 0 – through 1.2.6 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/mims-harvard/ToolUniverse product
- https://github.com/mims-harvard/ToolUniverse/pull/251 issue-tracking, patch
- GitHub Security Advisory (GHSA-pxwq-22vf-87fm) vendor-advisory
- VulnCheck Advisory: ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape third-party-advisory