CVE-2026-81096

ToolUniverse versions before 1.3.0 expose HTTP and MCP servers that run caller-supplied Python through the python_code_executor tool without requiring authentication, and the deny-list sandbox in python_executor_tool.py can be escaped. A caller can reach forbidden dunder attributes via string-based lookups or through an already-permitted module, walk from a literal's class to its base and its subclasses, and obtain references to the process and subprocess modules; a per-call argument can additionally widen the import allow-list before inspection runs. Because http_api_server.py and smcp_server.py bind to every interface with debugging enabled and no authentication, anyone able to reach the port can execute arbitrary code as the server process. Any deployment of ToolUniverse prior to 1.3.0 whose HTTP or MCP server is reachable by untrusted clients is affected. No public proof-of-concept or in-the-wild exploitation is currently known; EPSS estimates the 30-day exploitation probability at about 0.6% (45th percentile).

What to do: Upgrade to ToolUniverse 1.3.0 or later, which adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks. Until upgraded, restrict network access to the HTTP and MCP server ports with a firewall or an authenticating reverse proxy, avoid binding to all interfaces, and disable debug mode. Check any internet-exposed instances for signs of arbitrary code execution, since unauthenticated RCE requires no legitimate user interaction.