A critical vulnerability in ToolUniverse allows unauthenticated remote attackers to execute arbitrary code on the host server by bypassing sandbox restrictions and exploiting exposed API endpoints.

The application utilizes an insufficient blocklist for Python attribute lookups, enabling sandbox escapes via dunder methods and subclass enumeration. Furthermore, the HTTP and MCP API servers are configured to bind to all network interfaces without authentication, granting any network-adjacent attacker full control over the server process.

The ability for an unauthenticated remote attacker to execute arbitrary code results in a total compromise of the affected server. This facilitates unauthorized data access, potential lateral movement within the network, and complete loss of system integrity, justifying the maximum CVSS score of 10.0.

Immediate Action: Upgrade mims-harvard ToolUniverse to version 1.3.0 or later, which introduces mandatory bearer token authentication and restricts API binding to loopback addresses.

Proactive Monitoring: Inspect server logs for unauthorized connections to the HTTP or MCP API ports and monitor for anomalous child processes spawned by the ToolUniverse service.

Compensating Controls: Immediately restrict network access to the ToolUniverse API ports via host-based firewalls or network access control lists to ensure only trusted internal traffic can reach the service.

Public Exploit Available: No

This vulnerability represents the highest level of risk due to its unauthenticated, remote-accessible nature and the potential for full system compromise. Organizations must prioritize the update to version 1.3.0 immediately and ensure that the service is never exposed to untrusted networks without robust authentication and network-level access controls.