Junglewise Threat Intelligence

CVE-2026-55546: QWED-AI qwed-mcp unsafe SymPy parse_expr remote code execution

CVE-2026-55546 · Severity: critical · CVSS 9.8 · Published 2026-08-25

Executive brief

QWED-AI's qwed-mcp library is a Python package for mathematical expression verification used in downstream applications and services. A critical flaw in the verify_math_expression() function allows attackers to inject arbitrary system commands by passing specially crafted math expressions. Because the function uses Python's eval() without proper sandboxing, an attacker can execute arbitrary code with the same permissions as the application—including as root in containers—leading to complete system compromise.

Technical details

The vulnerability is a code injection flaw in src/qwed_mcp/engines/math_engine.py. The verify_math_expression() function accepts expression and claimed_result as untrusted strings and passes them to sympy.parsing.sympy_parser.parse_expr() after only a trivial ^ → ** substitution. Because parse_expr() ultimately calls Python's eval() with an unrestricted global namespace (lacking explicit {"__builtins__": {}}), all Python built-ins including __import__, open, and exec become available to the evaluated expression. An attacker can inject __import__('os').system('arbitrary-command') to execute OS commands. No authentication or network access controls gate the vulnerable function; any caller that provides user-controlled input to the public API is exploitable. The fix requires AST allowlisting and an empty global_dict with restricted builtins before both parse_expr() calls.

Affected products

  • QWED-AI qwed-mcp < 0.2.1 (affected 0.2.0)

Timeline

  • 2026-06-13: disclosed: GitHub Advisory published
  • 2026-08-25: advisory: Advisory updated
  • 2026: patched: Fix released in version 0.2.1

References