{"id":"CVE-2026-81096","summary":"ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape","details":"ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal's class to its base and enumerate subclasses to obtain a reference to the process and subprocess modules. A per-call argument also let the caller widen the import allow-list before the inspection ran. The HTTP and MCP servers in http_api_server.py and smcp_server.py bound to every interface with debugging enabled and no authentication, so any caller able to reach the port executed code as the server process. Version 1.3.0 adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks.","aliases":["GHSA-pxwq-22vf-87fm"],"modified":"2026-08-30T03:48:24.157767382Z","published":"2026-08-27T14:50:36.897Z","database_specific":{"cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81096.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81096.json"},{"type":"ADVISORY","url":"https://github.com/mims-harvard/ToolUniverse/security/advisories/GHSA-pxwq-22vf-87fm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81096"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/tooluniverse-through-1.2.6-unauthenticated-remote-code-execution-via-python-code-executor-sandbox-escape"},{"type":"FIX","url":"https://github.com/mims-harvard/ToolUniverse/pull/251"},{"type":"PACKAGE","url":"https://github.com/mims-harvard/ToolUniverse"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mims-harvard/tooluniverse","events":[{"introduced":"0"},{"last_affected":"ba98160c8813a9f345309c364684ce24649cb341"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"last_affected":"1.2.6"}]}}],"versions":["v1.2.6","v1.2.5","v1.2.4","v1.2.3","v1.2.2","v1.2.1","v1.1.11","v1.1.10","v1.1.9","v1.1.8","v1.1.7","v1.1.4","v1.1.3","v1.1.2","v1.1.1","v1.0.22","v1.0.21","v1.0.19.1","v1.0.19","v1.0.18","v1.0.17.9","v1.0.17.8","v1.0.17.7","v1.0.17.6","v1.0.17.5","v1.0.17.4","v1.0.17.3","v1.0.17.2","v1.0.17.1","v1.0.17","v1.0.16","v1.0.15.7","v1.0.15.6","v1.0.15.5","v1.0.15.4","v1.0.15.3","v1.0.15.2","v1.0.15.1","mcpb","v1.0.14.2","v1.0.14.1","v1.0.14","v1.0.13.2","v1.0.13.1","v1.0.12.7","v1.0.12.6","v1.0.12.5","v1.0.12.4","v1.0.12.3","v1.0.12.2","v1.0.12.1","v1.0.12","v1.0.11.2","v1.0.11.1","v1.0.11","v1.0.10","v1.0.9.1","v1.0.9","v1.0.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81096.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}