{"data":{"id":"c8c145fb-ba08-4705-b43e-2571867c9ed9","title":"GHSA-q27q-98j4-9pfv: qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`","summary":"The qwed package (version 5.1.1) has a critical vulnerability where user-supplied mathematical expressions are passed directly to SymPy's `parse_expr()` function without restrictions. Since `parse_expr()` internally uses Python's `eval()` (a function that runs arbitrary code), any authenticated user can execute malicious Python code on the server, leading to complete compromise. An attacker only needs to create a free account through the signup endpoint to exploit this.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-q27q-98j4-9pfv","publishedAt":"2026-08-25T16:25:19.000Z","cveId":"CVE-2026-55585","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["qwed@< 5.1.2 (fixed: 5.1.2)"],"affectedVendors":[],"affectedVendorsRaw":["qwed"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-08-25T16:25:19.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}