ToolUniverse allowed a user to execute arbitrary Python code without any authentication or sandbox restrictions. The python_code_executor component performed minimal attribute filtering, permitting attribute lookups that could be exploited via name mangling or module imports. An attacker could leverage these gaps to escape the sandbox, obtain references to the process and subprocess modules, and ultimately execute arbitrary commands on the host. The flaw enabled a full remote code execution scenario, compromising confidentiality, integrity, and availability of the underlying server.

The vulnerability affects ToolUniverse versions up to and including 1.2.6, released by mims-harvard. The scripts http_api_server.py and smcp_server.py in those releases exposed their endpoints on all network interfaces with debugging enabled and no authentication, meaning any network‑accessible client could submit malicious code. Versions starting at 1.3.0 have been fixed by introducing bearer‑token authentication, binding servers to localhost by default, and tightening attribute checks.

The flaw carries a CVSS score of 9.3, indicating critical severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, but the lack of authentication and exposed network interfaces mean that an attacker only needs to reach the service's port to launch an exploit. The vulnerability is fully exploitable in a single step, with no required privileges on the client side. Given these conditions, the risk remains high until patched or mitigated by blocking network access.