Executive brief
QWED is a mathematical expression verification service used in APIs. An attacker with a standard (freely obtainable) user account can submit specially crafted mathematical expressions to the `/verify/math` or `/verify/batch` endpoints that are evaluated using Python's eval() function, allowing arbitrary code execution inside the server process. This gives attackers full access to read sensitive files, modify data, execute system commands, and compromise the entire server and all other tenants' data.
Technical details
The vulnerability is a code injection flaw in src/qwed_new/api/main.py (lines 504 and 239 in batch.py) where attacker-controlled input from the `expression` or `query` request fields is passed directly to sympy.parsing.sympy_parser.parse_expr() without setting the restricted `global_dict` and `local_dict` parameters. SymPy's parse_expr() internally calls Python's eval(), making the full built-in namespace available. An attacker can use __import__() or other built-in functions to execute arbitrary code. The attack requires authentication (any standard user account), but registration is open to anyone via POST /auth/signup with no approval process. Successful exploitation grants the attacker full filesystem read/write access and the ability to execute arbitrary OS commands with the privileges of the server's process owner, leading to complete server compromise.
Affected products
- QWED-AI qwed < 5.1.2
Timeline
- 2026-06-14: disclosed: Published in GitHub Advisory Database
- 2026-06-14: patched: Patched in version 5.1.2
- 2026-08-25: advisory: Advisory updated with full details