Executive brief
ToolUniverse is a platform that executes user-supplied Python code for AI research. The service exposed a Python code executor on an unauthenticated web server accessible from any network interface, and its code sandbox could be escaped via dunder attribute traversal and dynamic imports. An attacker could reach the server and run arbitrary system commands with the privileges of the server process.
Technical details
The vulnerability consists of two root causes: (1) an incomplete Python AST sandbox in python_executor_tool.py that attempted to block dangerous attribute access via a denylist but failed to prevent getattr/dunder traversal (e.g., ().__class__.__bases__[0].__subclasses__()) and did not block per-call allowlist manipulation to import subprocess/os modules; and (2) unauthenticated HTTP and MCP servers in http_api_server.py and smcp_server.py binding to 0.0.0.0 with no authentication, making the executor reachable from any network source. An attacker with network access to the service port could call the python_code_executor tool with escaped Python code to obtain a reference to subprocess or os modules and execute arbitrary commands. Version 1.3.0 fixes both issues by hardening the sandbox (removing getattr/setattr, blocking all dunder access and literals, denylisting module-pivot escapes) and requiring bearer-token authentication with loopback-only default binding.
Affected products
- Harvard MIMS ToolUniverse before 1.3.0
Timeline
- 2026-08-27: disclosed: Published on NVD
- 2026-06-12: patched: Fix merged in PR #251 as version 1.3.0