Critical, CVSS 9.8PyPIAmendedPublished
qwed-mcp has Unsafe SymPy parse_expr() Remote Code Execution via Unsanitized Math Expression Input
CVE-2026-55546 · GHSA-mw6r-2hvm-4rp2
- Affected
- PyPI qwed-mcp < 0.2.1
- Fixed in
- 0.2.1· Vendor fix available
- Issue
- verifymathexpression() in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parseexpr() without restricting globaldict or validating the expression's AST. Because parseexpr() internally calls eval() and Python automatically injects the current module's builtins when no explicit restriction is set, an attacker can embed arbitrary Python expressions — including import('os').system(...) — to execute OS commands in the context of the running process. Confirmed exploitation in a Docker container yields root-level arbitrary command execution with no authentication or special configuration required. Details The vulnerability resides in src/qwedmcp/engines/mathengine.py. The public function verifymathexpression(expression, claimedresult, operation) accepts both the expression and claimedresult arguments as raw strings and passes them — after a trivial ^ → substitution — to sympy.parsing.sympyparser.parseexpr(): localdict only adds math symbols to the evaluation…
Recommended action: Upgrade to 0.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.