Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-81096— ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape

Quick assessment

Affected
mims-harvard ToolUniverse
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Artificial Intelligence for Medicine and Science @ Harvard Zitnik Lab ToolUniverse是Artificial Intelligence for Medicine and Science @ Harvard Zitnik Lab组织的一个汇聚多种机器学习与开发功能的软件工具集。 Artificial Intelligence for Medicine and Science @ Harvard Zitnik Lab ToolUni

CVSS 10.0 · Critical EPSS 0.85% · P58

Affected Version Matrix 1

VendorProduct Version RangeStatus
mims-harvard ToolUniverse ≤ 1.2.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81096

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape
Source: CVE Program / CVE List V5
Vulnerability Description
ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal's class to its base and enumerate subclasses to obtain a reference to the process and subprocess modules. A per-call argument also let the caller widen the import allow-list before the inspection ran. The HTTP and MCP servers in http_api_server.py and smcp_server.py bound to every interface with debugging enabled and no authentication, so any caller able to reach the port executed code as the server process. Version 1.3.0 adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Artificial Intelligence for Medicine and Science @ Harvard Zitnik Lab ToolUniverse 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Artificial Intelligence for Medicine and Science @ Harvard Zitnik Lab ToolUniverse是Artificial Intelligence for Medicine and Science @ Harvard Zitnik Lab组织的一个汇聚多种机器学习与开发功能的软件工具集。 Artificial Intelligence for Medicine and Science @ Harvard Zitnik Lab ToolUni
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
mims-harvard ToolUniverse 0 ~ 1.2.6 -

II. Public POCs for CVE-2026-81096

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81096

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-81096 (1)

Vendor Advisories for CVE-2026-81096 (2)

Proof of Concept for CVE-2026-81096 (1)

IV. Related Vulnerabilities

Same weakness: CWE-94

V. Comments for CVE-2026-81096

No comments yet

Leave a comment