The vulnerability stems from the PythonCodeTool's build method directly executing user-controlled code via exec() in the global namespace. The GitHub issue reproduction demonstrates how passing malicious code in tool_code (like os.popen calls) gets executed server-side. The lack of input validation, restricted namespaces, or sandboxing around the exec() call makes this a clear RCE vector. The code structure shown in the issue matches typical Python tool execution patterns in LangChain-based frameworks.