CVE-2026-81096
Received Received - Intake

Python Code Execution in ToolUniverse Sandbox Escape

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal's class to its base and enumerate subclasses to obtain a reference to the process and subprocess modules. A per-call argument also let the caller widen the import allow-list before the inspection ran. The HTTP and MCP servers in http_api_server.py and smcp_server.py bound to every interface with debugging enabled and no authentication, so any caller able to reach the port executed code as the server process. Version 1.3.0 adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81096
EUVD
EUVD-2026-67024

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mims-harvard tooluniverse 1.2.6
mims-harvard tooluniverse 1.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-81096 is a critical unauthenticated remote code execution (RCE) vulnerability in ToolUniverse's python_code_executor tool. The sandbox used to restrict Python code execution had flaws that allowed attackers to bypass security controls. Specifically, the executor did not properly block certain attribute lookups, enabling access to dangerous modules like process and subprocess through string-based traversal or module hierarchy manipulation. The HTTP and MCP servers were also bound to all network interfaces with debugging enabled and no authentication, allowing any remote caller to execute arbitrary code as the server process.

Detection Guidance

Check if ToolUniverse version 1.2.6 or earlier is running on your system. Inspect network interfaces for unbound or debug-enabled servers. Look for unauthorized access to python_code_executor or suspicious module imports like process or subprocess.

Impact Analysis

This vulnerability allows unauthenticated attackers to execute arbitrary code on the server running ToolUniverse versions before 1.3.0. If the server is exposed to the internet or a network, attackers could take full control of the system, steal data, install malware, or disrupt services. Even if the server is internal, compromise could lead to lateral movement within a network.

Compliance Impact

This vulnerability could lead to severe compliance violations under GDPR and HIPAA due to unauthorized data access or exfiltration. GDPR requires protection of personal data, and a breach could result in fines. HIPAA mandates strict controls for protected health information; a compromise could violate these requirements. Organizations using vulnerable versions must assess potential data exposure and report breaches as required.

Mitigation Strategies

Upgrade to ToolUniverse version 1.3.0 or later. Enable bearer-token authentication and restrict server binds to loopback interfaces. Block external access to debug ports and audit python_code_executor for unauthorized module usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81096. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart