CVE-2026-55546
Received Received - Intake

Command Injection in QWED-MCP via SymPy parse_expr

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy's parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because parse_expr() calls Python's eval() with built-ins available, an attacker who can cause a downstream caller to pass untrusted input to this public library function can use Python import functionality to execute arbitrary operating-system commands as the qwed-mcp process user, read or modify accessible data, exfiltrate process secrets, or reach internal services. The default MCP tool registry does not expose verify_math_expression(), so exploitation requires a downstream integration that invokes the library API with attacker-controlled input. This issue is fixed in version 0.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55546
EUVD
EUVD-2026-65547

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
qwed-ai qwed_mcp 0.2.0
qwed-ai qwed_mcp 0.2.1
qwed_mcp qwed_mcp to 0.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55546 is a critical remote code execution vulnerability in the QWED-MCP Python package affecting version 0.2.0. The issue occurs in the verify_math_expression() function which passes attacker-controlled input directly to SymPy's parse_expr() without proper sanitization. This allows attackers to inject malicious Python code, such as __import__('os').system('command'), to execute arbitrary operating system commands with the privileges of the running process.

Detection Guidance

To detect this vulnerability, check if your system runs qwed-mcp version 0.2.0 or earlier. Use commands like 'pip show qwed-mcp' or 'qwed-mcp --version' to verify the installed version. Inspect logs for unusual activity from the qwed-mcp process, such as unexpected command executions or file access attempts.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands, read or modify files accessible to the process, exfiltrate sensitive data like environment variables or API keys, and potentially pivot to other internal services. Exploitation requires a downstream integration that calls verify_math_expression() with attacker-controlled input.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, including personal or health information, which would violate GDPR and HIPAA compliance requirements. Attackers could read, modify, or exfiltrate data, potentially exposing regulated information without authorization.

Mitigation Strategies

Immediately upgrade qwed-mcp to version 0.2.1 or later using 'pip install --upgrade qwed-mcp'. If you cannot upgrade, restrict network access to the qwed-mcp service and monitor for suspicious activity. Review any downstream integrations using the verify_math_expression() API to ensure they do not pass untrusted input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55546. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart