CVE-2026-81096 in ToolUniverse
Summary
by MITRE • 08/27/2026
ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal's class to its base and enumerate subclasses to obtain a reference to the process and subprocess modules. A per-call argument also let the caller widen the import allow-list before the inspection ran. The HTTP and MCP servers in http_api_server.py and smcp_server.py bound to every interface with debugging enabled and no authentication, so any caller able to reach the port executed code as the server process. Version 1.3.0 adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
ToolUniverse contained a critical remote code execution vulnerability stemming from an insecure Python sandbox implementation that allowed attackers to escape isolation boundaries on unauthenticated servers. The core flaw resided in the python_code_executor tool located within python_executor_tool.py, which was designed to execute user-supplied Python code under restricted conditions. However, the security controls implemented were insufficient against determined adversaries familiar with Python's introspection capabilities and object model traversal techniques. Specifically, while the executor inspected submitted source code for a denied list of attribute names and function calls, it failed to adequately restrict access to built-in attributes that facilitate class hierarchy navigation. This oversight allowed an attacker to bypass the intended restrictions by leveraging dunder methods or string-based lookups to traverse from literal objects up through their base classes and subsequently enumerate subclasses. Through this mechanism, attackers could obtain references to sensitive modules such as process and subprocess, thereby gaining the ability to execute arbitrary system commands outside the sandbox environment.
The severity of this vulnerability was significantly amplified by architectural decisions regarding network exposure and authentication mechanisms. The HTTP API server defined in http_api_server.py and the MCP server defined in smcp_server were both configured to bind to all available network interfaces with debugging features enabled and without any form of authentication required. This configuration meant that any external actor capable of reaching the service port could interact directly with the vulnerable components. Consequently, an unauthenticated remote attacker could exploit the sandbox escape vector described above to execute code with the privileges of the server process itself. The combination of unrestricted network binding, lack of access control, and a flawed execution environment created a high-severity attack surface that effectively rendered the service completely insecure against any internet-facing deployment or internal network exposure where lateral movement was possible.
This vulnerability aligns closely with CWE-94 Improper Control of Generation of Code (Code Injection) as it involves the injection of arbitrary code into an interpreter, and CWE-78 Improproper Neutralization of Special Elements used in an OS Command if the escape leads to shell execution. Furthermore, from a tactical perspective, this exploitation path corresponds to ATT&CK technique T1059 Command and Scripting Interpreter, specifically leveraging Python for remote command execution, as well as T1620 Reflective Code Loading or similar techniques involving object introspection to bypass security restrictions. The ability to enumerate classes and access modules via string lookups represents a sophisticated evasion of static analysis defenses commonly found in naive sandbox implementations that rely solely on keyword blocking rather than comprehensive runtime isolation.
The issue was addressed in version 1.3.0 through several critical hardening measures designed to close the identified attack vectors. The update introduced bearer-token authentication, which ensures that only authorized users with valid credentials can access the API endpoints and execute code. Additionally, the default bind address for both HTTP and MCP servers was changed from all interfaces to loopback-only, significantly reducing the external attack surface by preventing direct internet-facing exposure unless explicitly configured otherwise. Finally, the attribute checks within the Python executor were hardened to prevent the traversal of class hierarchies via dunder attributes or string-based lookups, effectively neutralizing the sandbox escape technique that relied on introspecting built-in objects to access restricted modules like subprocess and os. These changes collectively restore a secure operational posture by enforcing authentication, limiting network exposure, and strengthening code execution restrictions.