CVE-2026-81096: Improper Control of Generation of Code ('Code Injection') in mims-harvard ToolUniverse

ToolUniverse's python_code_executor tool in versions up to 1.2.6 improperly controlled code generation by running caller-supplied Python inside a sandbox that could be escaped. The executor inspected source code against a deny list but left attribute-lookup builtins accessible, enabling attackers to traverse object hierarchies and import sensitive modules like process and subprocess. The server components bound to all interfaces with debugging enabled and no authentication, allowing unauthenticated remote code execution as the server process. Version 1.3.0 introduces bearer-token authentication, restricts binding to loopback, and hardens attribute inspections to mitigate this vulnerability.

An unauthenticated attacker able to reach the server port could execute arbitrary code with the privileges of the server process. This allows full compromise of the host running ToolUniverse versions up to 1.2.6. The vulnerability is critical with a CVSS 4.0 score of 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Version 1.3.0 of ToolUniverse includes fixes that add bearer-token authentication, restrict the server to bind only to the loopback interface by default, and improve attribute filtering to prevent sandbox escape. Users should upgrade to version 1.3.0 or later to remediate this vulnerability. No official patch or remediation level is explicitly stated beyond this version update. Until upgraded, restricting network access to the server ports and disabling debugging features may reduce exposure.