CVE-2026-55585
Received Received - Intake

Code Execution in QWED AI Verification Infrastructure

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parse_expr() without restricted global_dict and local_dict namespaces, allowing Python eval() to resolve builtins and execute arbitrary Python code in the API server process. In src/qwed_new/api/main.py, POST /verify/math is protected by get_current_tenant but accepts any valid tenant API key, reads the expression field, applies only a cosmetic re.sub(r'(\d)(()', r'\1*\2', expression) normalization, and passes the result to parse_expr(). In src/qwed_new/core/batch.py, POST /verify/batch sends math items through batch_service.create_job(), stores item.query verbatim, and _verify_item() passes VerificationType.MATH input to parse_expr() without sanitization. The default-enabled POST /auth/signup endpoint allows anyone to create a standard tenant account, POST /auth/api-keys issues an x-api-key, and either vulnerable path can then be used to read or write files, modify data, execute operating system commands, terminate the service, and compromise other tenants in a shared deployment. This issue is fixed in version 5.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55585
EUVD
EUVD-2026-65580

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
qwed-ai qwed 5.1.2
qwed-ai qwed 5.1.1
qwed qwed 5.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Authenticated Remote Code Execution (RCE) flaw in the QWED AI verification system. It allows attackers with a valid tenant account to execute arbitrary Python code on the server by passing malicious mathematical expressions to SymPy's parse_expr() function. The issue exists in versions prior to 5.1.2 and affects endpoints like /verify/math and /verify/batch. Attackers can gain full filesystem access, execute OS commands, modify data, or terminate the service.

Detection Guidance

To detect this vulnerability, check if your QWED instance is running a version prior to 5.1.2. Inspect API endpoints like /verify/math and /verify/batch for unsanitized math expression handling. Look for signs of unauthorized file access, OS command execution, or unexpected tenant activity in logs.

Impact Analysis

If you use QWED versions before 5.1.2, an attacker with a standard tenant account (obtained via /auth/signup) could exploit this to read or write files, execute operating system commands, modify other tenants' data in shared deployments, or completely compromise your server. The impact includes data theft, service disruption, or full system takeover.

Compliance Impact

This vulnerability could lead to severe compliance violations. GDPR requires protecting personal data; a breach could expose sensitive information. HIPAA mandates securing health data; unauthorized access violates this. The RCE risk means attackers could access, modify, or delete regulated data, resulting in legal penalties, fines, and reputational damage for organizations failing to patch this flaw.

Mitigation Strategies
  • Upgrade QWED to version 5.1.2 or later immediately to apply the security fixes.
  • Review and restrict access to /auth/signup and /auth/api-keys endpoints to prevent unauthorized tenant creation.
  • Audit logs for any signs of exploitation, such as unexpected file operations or OS command execution.
  • Implement network segmentation to isolate the QWED service and limit lateral movement if compromised.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55585. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart