Description

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy's parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because parse_expr() calls Python's eval() with built-ins available, an attacker who can cause a downstream caller to pass untrusted input to this public library function can use Python import functionality to execute arbitrary operating-system commands as the qwed-mcp process user, read or modify accessible data, exfiltrate process secrets, or reach internal services. The default MCP tool registry does not expose verify_math_expression(), so exploitation requires a downstream integration that invokes the library API with attacker-controlled input. This issue is fixed in version 0.2.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-25T16:16:55.160Z",
  "pubdate": "2026-08-25T16:16:55.160Z",
  "executiveSummary": "The QWED-MCP library prior to version 0.2.1 contains a critical arbitrary code execution vulnerability within its math engine component.\nThe flaw stems from the insecure usage of SymPy's parse_expr() function, which utilizes Python's eval() internally to process mathematical expressions.\nBy passing attacker-controlled input directly to the parsing engine without proper sanitization, validation, or the restriction of Python built-ins, the library enables remote attackers to execute arbitrary system commands under the context of the host process.\nThe vulnerability resides in src/qwed_mcp/engines/math_engine.py within the verify_math_expression() function.\nWhile the default MCP tool registry does not expose this function, any downstream integration that incorporates user-provided data into this API call is susceptible to exploitation.\nImpact includes full system compromise, data exfiltration, and unauthorized access to internal services, depending on the privileges of the executing process.\nThe vulnerability is resolved in version 0.2.1, which mandates an update for all downstream consumers utilizing the library's verification functionality.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of SymPy's parse_expr() within the verify_math_expression() function in src/qwed_mcp/engines/math_engine.py. The function attempts to verify mathematical expressions by accepting an expression and a claimed result string. However, it performs only a rudimentary normalization of caret syntax to Python-style exponentiation before passing these strings directly to the parser.\nSymPy's parse_expr() function is designed to convert a string into a SymPy expression object. By default, this function utilizes Python’s eval() to interpret the input. Because the implementation in QWED-MCP fails to restrict the global_dict parameter or strip Python built-ins from the evaluation context, the parser inherits the full capabilities of the underlying Python runtime environment. An attacker can leverage Python's import system—specifically by referencing modules such as 'os' or 'subprocess'—to escape the intended mathematical verification sandbox.\nThe attack flow begins when a downstream application accepts untrusted user input and passes it to the vulnerable verify_math_expression() interface. An attacker can craft a malicious string that contains standard Python expression syntax combined with payload execution vectors. For example, by embedding '__import__(\"os\").system(\"command\")' within the input string, the attacker forces the parser to execute the shell command when the expression is evaluated during the verification phase.\nSince the execution occurs with the same privileges as the qwed-mcp process, the attacker gains the ability to perform any action permitted to that user account. This includes reading sensitive files, exfiltrating process-specific secrets, modifying application data, or pivoting to internal network services that the host process can reach.\nThe vulnerability affects all versions of QWED-MCP prior to 0.2.1. Exploitation does not require authentication to the library itself, as it is a programmatic flaw triggered by the application logic. The risk is highly dependent on the exposure of the downstream API; however, once the payload reaches the math engine, there are no internal mechanisms in the vulnerable versions to halt the execution of injected Python bytecode, representing a complete failure of input validation and safe evaluation practices."
}