CVE-2026-81096 ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-81096?
CVE-2026-81096 is a critical vulnerability in mims-harvard ToolUniverse, published on 27 Aug 2026.
Official description
ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal's class to its base and enumerate subclasses to obtain a reference to the process and subprocess modules. A per-call argument also let the caller widen the import allow-list before the inspection ran. The HTTP and MCP servers in http_api_server.py and smcp_server.py bound to every interface with debugging enabled and no authentication, so any caller able to reach the port executed code as the server process. Version 1.3.0 adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks.
Weakness: CWE-94
Which versions are affected by CVE-2026-81096?
How do I fix CVE-2026-81096?
No fix has been published for CVE-2026-81096 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81096 being exploited?
There is no known exploitation of CVE-2026-81096 in the wild and no public exploit code.
Sources
Also known as GHSA-pxwq-22vf-87fm, GHSA-rg68-wg77-c3wm.