https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 10:29:21 +0000 https://vulnerability.circl.lu/vuln/cve-2026-55546 <p><strong>Affected:</strong> QWED-AI qwed-mcp</p> <p>QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy&#39;s parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because parse_expr() calls Python&#39;s eval() with built-ins available, an attacker who can cause a downstream caller to pass untrusted input to this public library function can use Python import functionality to execute arbitrary operating-system commands as the qwed-mcp process user, read or modify accessible data, exfiltrate process secrets, or reach internal services. The default MCP tool registry does not expose verify_math_expression(), so exploitation requires a downstream integration that invokes the library API with attacker-controlled input. This issue is fixed in version 0.2.1.</p> <p><strong>Affected:</strong> QWED-AI qwed-mcp</p> <p>QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy&#39;s parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because parse_expr() calls Python&#39;s eval() with built-ins available, an attacker who can cause a downstream caller to pass untrusted input to this public library function can use Python import functionality to execute arbitrary operating-system commands as the qwed-mcp process user, read or modify accessible data, exfiltrate process secrets, or reach internal services. The default MCP tool registry does not expose verify_math_expression(), so exploitation requires a downstream integration that invokes the library API with attacker-controlled input. This issue is fixed in version 0.2.1.</p> https://vulnerability.circl.lu/vuln/cve-2026-55546 https://vulnerability.circl.lu/vuln/pysec-2026-3915 <p><strong>Affected:</strong> PyPI: qwed-mcp</p> <p>### Summary</p> <p>`verify_math_expression()` in `qwed-mcp` v0.2.0 passes attacker-controlled strings directly to SymPy&#39;s `parse_expr()` without restricting `global_dict` or validating the expression&#39;s AST. Because `parse_expr()` internally calls `eval()` and Python automatically injects the current module&#39;s `__builtins__` when no explicit restriction is set, an attacker can embed arbitrary Python expressions — including `__import__(&#39;os&#39;).system(...)` — to execute OS commands in the context of the running process. Confirmed exploitation in a Docker container yields root-level arbitrary command execution with no authentication or special configuration required.</p> <p>### Details</p> <p>The vulnerability resides in `src/qwed_mcp/engines/math_engine.py`. The public function `verify_math_expression(expression, claimed_result, operation)` accepts both the `expression` and `claimed_result` arguments as raw strings and passes them — after a trivial `^` → `**` substitution — to `sympy.parsing.sympy_parser.parse_expr()`:</p> <p>```python # math_engine.py:50-54 expr = parse_expr( expression.replace(&#34;^&#34;, &#34;**&#34;), local_dict={&#34;x&#34;: x, &#34;y&#34;: y, &#34;z&#34;: z, &#34;pi&#34;: pi, &#34;e&#34;: E}, transformations=transformations ) ```</p> <p>```python # math_engine.py:64-68 claimed = parse_expr( claimed_result.replace(&#34;^&#34;, &#34;**&#34;), local_dict={&#34;x&#34;: x, &#34;y&#34;: y, &#34;z&#34;: z, &#34;pi&#34;: pi, &#34;e&#34;: E}, transformations=transformations ) ```</p> <p>`local_dict` only adds math symbols to the evaluation namespace; it does **not** remove `__builtins__`…</p> <p><strong>Affected:</strong> PyPI: qwed-mcp</p> <p>### Summary</p> <p>`verify_math_expression()` in `qwed-mcp` v0.2.0 passes attacker-controlled strings directly to SymPy&#39;s `parse_expr()` without restricting `global_dict` or validating the expression&#39;s AST. Because `parse_expr()` internally calls `eval()` and Python automatically injects the current module&#39;s `__builtins__` when no explicit restriction is set, an attacker can embed arbitrary Python expressions — including `__import__(&#39;os&#39;).system(...)` — to execute OS commands in the context of the running process. Confirmed exploitation in a Docker container yields root-level arbitrary command execution with no authentication or special configuration required.</p> <p>### Details</p> <p>The vulnerability resides in `src/qwed_mcp/engines/math_engine.py`. The public function `verify_math_expression(expression, claimed_result, operation)` accepts both the `expression` and `claimed_result` arguments as raw strings and passes them — after a trivial `^` → `**` substitution — to `sympy.parsing.sympy_parser.parse_expr()`:</p> <p>```python # math_engine.py:50-54 expr = parse_expr( expression.replace(&#34;^&#34;, &#34;**&#34;), local_dict={&#34;x&#34;: x, &#34;y&#34;: y, &#34;z&#34;: z, &#34;pi&#34;: pi, &#34;e&#34;: E}, transformations=transformations ) ```</p> <p>```python # math_engine.py:64-68 claimed = parse_expr( claimed_result.replace(&#34;^&#34;, &#34;**&#34;), local_dict={&#34;x&#34;: x, &#34;y&#34;: y, &#34;z&#34;: z, &#34;pi&#34;: pi, &#34;e&#34;: E}, transformations=transformations ) ```</p> <p>`local_dict` only adds math symbols to the evaluation namespace; it does **not** remove `__builtins__`…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3915