Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81096— ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape

Quick assessment

Affected
mims-harvard ToolUniverse
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ToolUniverse 在一个沙箱中运行调用方提供的 Python 代码，但该沙箱可被逃逸，而运行它的服务器并未要求任何身份验证。位于 中、 工具背后的执行器会检查提交源码中是否包含被禁止的属性名称和调用，但保留了通过字符串查找可达到的双下划线（dunder）属性，也未能阻止通过已允许的模块访问双下划线属性。因此，调用方可以从某个字面量的类出发，向其基类遍历并枚举子类，从而获取到 和 模块的引用。此外，一个按次调用的参数还允许调用方在检查运行之前扩大导入允许列表。 和 中的 HTTP 和 MCP 服务器绑定到所有

CVSS 10.0 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
mims-harvard ToolUniverse ≤ 1.2.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81096

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape
Source: CVE Program / CVE List V5
Vulnerability Description
ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal's class to its base and enumerate subclasses to obtain a reference to the process and subprocess modules. A per-call argument also let the caller widen the import allow-list before the inspection ran. The HTTP and MCP servers in http_api_server.py and smcp_server.py bound to every interface with debugging enabled and no authentication, so any caller able to reach the port executed code as the server process. Version 1.3.0 adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
mims-harvard ToolUniverse 0 ~ 1.2.6 -

II. Public POCs for CVE-2026-81096

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81096

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-81096 (1)

Vendor Advisories for CVE-2026-81096 (2)

Proof of Concept for CVE-2026-81096 (1)

IV. Related Vulnerabilities

Same weakness: CWE-94

V. Comments for CVE-2026-81096

No comments yet

Leave a comment