{"apiVersion":"1.0","identifier":"CVE-2026-81096","description":"ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal-s class to its base and enumerate subclasses to obtain a reference to the process and subprocess modules. A per-call argument also let the caller widen the import allow-list before the inspection ran. The HTTP and MCP servers in http_api_server.py and smcp_server.py bound to every interface with debugging enabled and no authentication, so any caller able to reach the port executed code as the server process. Version 1.3.0 adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks.","publishedAt":"2026-08-27T17:20:51","lastModifiedAt":"2026-08-27T20:18:49","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81096","cvssScore":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","epssProbability":0.00574,"riskScore":1.05,"affectedProduct":"ToolUniverse","affectedVersions":"<1.3.0","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-81096","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-81096","en":"https://www.redsauce.net/en/cves/CVE-2026-81096","fr":"https://www.redsauce.net/fr/cves/CVE-2026-81096","pt":"https://www.redsauce.net/pt/cves/CVE-2026-81096","de":"https://www.redsauce.net/de/cves/CVE-2026-81096","sk":"https://www.redsauce.net/sk/cves/CVE-2026-81096","el":"https://www.redsauce.net/el/cves/CVE-2026-81096"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-81096"}}