Authenticated Remote Code Execution via Unsafe SymPy parse_expr()
- Package
qwed- Severity & Score
- High — CVSS 3.1: 8.8
- Affected Versions
- 5.1.1
- Fixed Version
- 5.1.2
Summary
CVE-2026-55585 affects qwed 5.1.1. The affected mathematical-expression parsing paths did not sufficiently restrict caller-controlled expressions. In applicable deployments, this could allow arbitrary code execution in the API server process. The issue is fixed in qwed 5.1.2.
Who is affected
You should review and upgrade if you deployed qwed 5.1.1, especially where the affected verification endpoints or batch flows could process tenant-controlled mathematical expressions. If you are already running qwed 5.1.2 or later, confirm that your deployed artifact and dependency lock files reflect the fixed release.
Remediation
Upgrade to qwed 5.1.2 or later. Review the published GitHub Security Advisory and the fixed release for complete version-specific guidance. If the affected version was exposed in a multi-tenant or production deployment, follow your organization’s incident-response process to assess logs, secrets, and downstream exposure.
Technical impact
The issue involved unsafe mathematical-expression parsing in supported API and batch-verification paths. The remediation replaced direct production parsing with a restricted safe-parsing boundary and added validation and regression coverage. The full technical record is available in the GitHub Security Advisory and the remediation pull request.
Disclosure timeline
Remediation proposed
PR #200 was opened by Sebastian Höpfl / @sebastionoss, providing a public safe-parsing remediation proposal.[Source]
Remediation merged & advisory published
PR #200 was merged; the GitHub Security Advisory was published.[Source]
Reporter credit acknowledged
EQSTLab is publicly credited as reporter in the GitHub Security Advisory.[Source]
CVE identifier assigned
GitHub assigned CVE-2026-55585, according to the advisory’s public history.
Credits
We appreciate the contributors who helped identify, validate, remediate, and disclose this issue. Credit is stated according to the public disclosure record and does not imply a general audit engagement.