ToolUniverse Ran Caller-Supplied Python Behind a Denylist Sandbox on an Unauthenticated Server (CVE-2026-81096, 9.3)

NVD·medium signalXBlueskyLinkedInCopy link

The executor behind ToolUniverse's `python_code_executor` tool in `python_executor_tool.py` inspected submitted source against a denied list of attribute names and calls, leaving the attribute-access escapes that always defeat that approach, and the server required no authentication at all. Denylist sandboxing of Python is a known-losing design, and shipping it in front of an open port compounds it. If you are building a code-execution MCP tool, the boundary has to be a process or container, not a string scan of the source.