{"id":"CVE-2026-81096","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-81096","summary":"ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py,…","details":"ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal's class to its base and enumerate subclasses to obtain a reference to the process and subprocess modules. A per-call argument also let the caller widen the import allow-list before the inspection ran. The HTTP and MCP servers in http_api_server.py and smcp_server.py bound to every interface with debugging enabled and no authentication, so any caller able to reach the port executed code as the server process. Version 1.3.0 adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks.","published":"2026-08-27T17:20:51.950","modified":"2026-08-27T17:20:51.950","cvss":{"score":10,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/mims-harvard/ToolUniverse/pull/251","label":"mims-harvard/ToolUniverse#251"},"references":[{"type":"WEB","url":"https://github.com/mims-harvard/ToolUniverse"},{"type":"WEB","url":"https://github.com/mims-harvard/ToolUniverse/pull/251"},{"type":"WEB","url":"https://github.com/mims-harvard/ToolUniverse/security/advisories/GHSA-pxwq-22vf-87fm"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/tooluniverse-through-1.2.6-unauthenticated-remote-code-execution-via-python-code-executor-sandbox-escape"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T17:20:51.950"}}