CVE-2026-81096

Name of the Vulnerable Software and Affected Versions ToolUniverse versions prior to 1.3.0

Description The software executes caller-supplied Python code within a sandbox that can be escaped. The executor in python executor tool.py uses a denied list for attribute names and calls but fails to block dunder attributes accessed via string lookups or permitted modules. This allows an attacker to navigate from a literal's class to its base and enumerate subclasses to gain references to the process and subprocess modules. Additionally, a per-call argument allows the caller to expand the import allow-list before inspection. The HTTP and MCP servers in http api server.py and smcp server.py bind to all interfaces with debugging enabled and no authentication, allowing any user with network access to the port to execute code as the server process.

Recommendations Update to version 1.3.0.