Unsafe SymPy parse_expr() Remote Code Execution via Unsanitized Math Expression Input
- Package
qwed-mcp- Severity & Score
- Critical — CVSS 3.1: 9.8
- Affected Versions
- 0.2.0
- Fixed Version
- 0.2.1
Summary
CVE-2026-55546 affects qwed-mcp 0.2.0. The affected mathematical-expression verification library function did not sufficiently restrict untrusted expression input. In a downstream integration that passes attacker-controlled input to the affected function, this could allow arbitrary code execution in the process running qwed-mcp. The issue is fixed in qwed-mcp 0.2.1.
Who is affected
You should upgrade if you use qwed-mcp 0.2.0, particularly if a downstream application or custom integration passes untrusted input to the affected mathematical-expression verification function. Review integration boundaries as part of the upgrade.
Remediation
Upgrade to qwed-mcp 0.2.1 or later. Review the GitHub Security Advisory and fixed release before concluding that a deployment is unaffected. Follow your organization’s incident-response process if the affected library API was exposed to untrusted input in a production environment.
Technical impact
The issue involved unsafe handling of untrusted mathematical-expression input in a qwed-mcp verification function. The update applies a safer parsing boundary. The public GitHub Security Advisory describes the affected conditions and fixed package version.
Disclosure timeline
Advisory published
GitHub Security Advisory GHSA-mw6r-2hvm-4rp2 was published.[Source]
Credits
We appreciate the contributors who helped identify, validate, remediate, and disclose this issue. Credit is stated according to the public disclosure record and does not imply a general audit engagement.