ToolUniverse CVE-2026-81096

Exploitation requires network reachability to the ToolUniverse HTTP API (http_api_server.py) or SMCP/MCP server (smcp_server.py) with the python_code_executor tool available. In vulnerable versions (through 1.2.6) these servers bind to every interface (0.0.0.0) with debugging enabled and no authentication, so on a default network-exposed deployment there are no special conditions - remote unauthenticated exploitation succeeds against any reachable instance. The sandbox escape itself needs no privileged input: the deny-list inspection is bypassed through dunder attributes reached via string/attribute lookup and via a per-call argument that widens the import allow-list. What LIMITS exploitation is deployment posture: an instance bound only to loopback (the 1.3.0 default) or protected by the new TOOLUNIVERSE_API_TOKEN bearer authentication is not reachable/executable by an unauthenticated remote attacker, and instances never exposed beyond localhost are not remotely exploitable.

This is a genuine top-priority issue, not an inflated CVSS number. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) is consistent with the description: network-reachable, low complexity, no privileges, no user interaction, and full compromise of confidentiality, integrity, and availability. The combination of an escapable sandbox and a server that binds to every interface without authentication means exploitation collapses to 'reach the port, get code execution as the server process,' which is directly automatable. No EPSS score or CISA KEV status was provided in the input, and no public exploit code is identified at time of analysis, so there is no confirmation of active exploitation - the severity rests on the design flaw and VulnCheck's report rather than observed in-the-wild activity. The main mitigating factor is real-world exposure: ToolUniverse is a niche research toolkit, so the population of internet-reachable instances is likely small, favoring targeted opportunistic scanning over mass exploitation. Any operator running an exposed instance should treat patching as urgent regardless of that low footprint.

An attacker scans for ToolUniverse HTTP/MCP ports exposed on 0.0.0.0 and, without any credentials, submits a python_code_executor request whose source uses ().__class__.__base__.__subclasses__() to reach subprocess and run OS commands. Because AV:N/AC:L/PR:N/UI:N applies, a single crafted request to the open port yields code execution as the server process; no public exploit code is identified, but the escape technique is described in the VulnCheck advisory.