CVE-2026-81096: Improper Control of Generation of Code

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the pythoncodeexecutor tool, in pythonexecutortool.py, inspected the submitted source for a denied list of attribute names and calls but left the...