A ToolUniverse sandbox let a caller walk from a literal to the subprocess module

What happened

ToolUniverse’s python_code_executor checked submitted code against a denylist of attribute names but left the attribute-lookup builtins reachable, so a caller could climb from a literal’s class to its base classes, enumerate subclasses and reach the process and subprocess modules. Its HTTP and MCP servers also bound to every interface with debugging enabled.

A denylist of names is not a sandbox when the language can still reach the objects by another route, and the subclass walk is the oldest way round it. NVD scores it 10.0 critical on CVSS 3.1 and 9.3 critical on CVSS 4.0. Fixed in 1.3.0.