Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-81096: ToolUniverse lets anyone run unsafe Python code
CVE-2026-81096 · published 7 days ago
Summary
ToolUniverse runs user‑provided Python scripts in a sandbox that can be broken out of, and the service is reachable without any login. An attacker could use this to execute commands on the server and access its data. Updating to the latest version adds authentication, limits network exposure, and strengthens the sandbox checks.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mims-harvard | tooluniverse | <= 1.2.6 |
Original advisory text
ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape
ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal's class to its base and enumerate subclasses to obtain a reference to the process and subprocess modules. A per-call argument also let the caller widen the import allow-list before the inspection ran. The HTTP and MCP servers in http_api_server.py and smcp_server.py bound to every interface with debugging enabled and no authentication, so any caller able to reach the port executed code as the server process. Version 1.3.0 adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks.
References
- https://github.com/mims-harvard/ToolUniverse
- https://github.com/mims-harvard/ToolUniverse/pull/251
- https://github.com/mims-harvard/ToolUniverse/security/advisories/GHSA-pxwq-22vf-...
- https://www.vulncheck.com/advisories/tooluniverse-through-1.2.6-unauthenticated-...
- https://nvd.nist.gov/vuln/detail/CVE-2026-81096 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81096... Vendor Advisory
Severity
9.3
Critical
CVSS 3.1: 10.0 (NVD)
CVSS 4.0: 9.3 (NVD)
CVSS 4.0: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-94Code Injection
Timeline
Published27 Aug 2026
Updated3 Sep 2026
First seen27 Aug 2026
Monitor software like this
Free during beta