GHSA-mw6r-2hvm-4rp2: qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

Summary

qwed-mcp v0.2.0 passes attacker-controlled strings to SymPy's parse_expr() in src/qwed_mcp/engines/math_engine.py without restricting global_dict or validating the expression's AST. Because parse_expr() calls eval() and Python injects __builtins__ by default, an attacker can embed expressions such as __import__('os').system(...) to run OS commands in the running process. The source reports confirmed root-level execution in a Docker container, requiring no authentication or special configuration.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-122160: myshell-ai AIlice HuggingFace Model Wrapper untrusted model loadingSimilar attack · NVD/CVE Database
• MediumCVE-2026-122159: Edge0-AI Audio8_TTS path traversal via slow_decode_models argumentSimilar attack · NVD/CVE Database
• MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
• HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
• HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database