All vulnerabilities

CVE-2026-81096

ToolUniverse through 1.2.6: unauthenticated RCE via python_code_executor sandbox escape

criticalCVSS 9.3CWE-94

Vendor

ToolUniverse

Package

ToolUniverse pip

Affected

<= 1.2.6

Disclosed

2026-08-27

Credit

Avishai Gonen

rcesandbox-escapemcp

Published advisory