Critical RCE in qwed-mcp: Unsandboxed SymPy parse_expr() Allows Arbitrary Command Execution (CVE-2026-55546)

A GitHub Security Advisory (GHSA-mw6r-2hvm-4rp2) published August 25, 2026 discloses a critical remote code execution vulnerability in qwed-mcp v0.2.0, a PyPI package, tracked as CVE-2026-55546 with a reported CVSS of 9.8. A public proof-of-concept is available.

What was reported

According to the advisory, the verify_math_expression() function in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly into SymPy's parse_expr() after only a trivial ^ → ** substitution, with no AST validation or allowlisting. parse_expr() internally calls Python's eval(), and because the code never sets global_dict={"__builtins__": {}}, Python injects the full builtins namespace into the evaluation — making __import__, open, and exec reachable. The advisory includes a PoC where a payload such as __import__('os').system(...) passed as the expression argument executed arbitrary OS commands, demonstrated in a Docker container as root, with no authentication or special configuration required.

Why it matters for defenders

The advisory states the vulnerable function is directly importable from the public PyPI library API — any application, script, or service that calls verify_math_expression() with user- or model-supplied input inherits this RCE, regardless of whether the function is registered as an exposed MCP tool. The advisory notes v0.2.0's default MCP tool registry does not register this function, which narrows immediate exposure to code that wraps or calls the library directly rather than every MCP deployment. Where reachable, impact per the advisory includes arbitrary command execution as the process user, file read/write/delete, and exfiltration of secrets/environment variables from the process context.

What to watch for / do now

• Inventory any use of the qwed-mcp package (PyPI) and identify all call sites of verify_math_expression(), particularly anywhere expression or claimed-result input originates from an external user, LLM tool call, or untrusted service.
• Until a patched release is confirmed, treat any exposed path to this function as equivalent to unauthenticated code execution; consider disabling or isolating the math-verification feature in affected deployments.
• Hunt for anomalous child processes spawned from Python interpreters running this package (e.g., python3 parent spawning sh/bash/id/network tools), unexpected outbound connections from hosts running MCP-adjacent tooling, and file writes to unusual paths from Python processes.
• For remediation, the advisory's suggested fix restricts the evaluation namespace (global_dict={"__builtins__": {}}) and adds AST-based allowlisting of permitted names/functions before calling parse_expr() — apply equivalent hardening to any similar pattern where untrusted strings reach SymPy or Python's eval().

This is fresh, developing intelligence based solely on the GHSA disclosure; patch status and broader downstream impact were not independently verified at publication time. See the original advisory for full technical details: GHSA-mw6r-2hvm-4rp2.