What is the CVSS score of CVE-2026-55546?

CVE-2026-55546 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of QWED-MCP are affected by CVE-2026-55546?

QWED-MCP library before version 0.2.1 contains a critical remote code execution vulnerability that enables arbitrary code execution with root-level privileges on any system integrating this library.. A patch is available.

Is there a public PoC exploit available for CVE-2026-55546?

Yes, a public proof-of-concept exploit is available for CVE-2026-55546. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-55546?

Publicly available exploit code exists. Within 24 hours, conduct urgent inventory of all systems and applications using QWED-MCP and classify as critical security incidents. Within 7 days, implement emergency compensating controls: disable QWED-MCP library functions where operationally feasible, restrict network access to affected systems, and mandate strict input validation to prevent untrusted expressions from reaching the vulnerable API. Within 30 days, execute permanent remediation by either upgrading to QWED-MCP 0.2.1 or later once released by the vendor, or migrating to an alternative math-verification solution that does not rely on dynamic expression parsing.

QWED-MCP CVE-2026-55546

EUVD-2026-65547 CRITICAL

Code Injection (CWE-94)

2026-08-25 GitHub_M

GHSA-mw6r-2hvm-4rp2

RCE Python Code Injection Qwed Mcp

9.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Full RCE gives C:H/I:H/A:H and no auth (PR:N), but exploitation depends on a non-default downstream integration exposing the function, so AC:H rather than AC:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 25, 2026 - 17:17 EUVD

Source Code Evidence Fetched

Aug 25, 2026 - 16:10 vuln.today

Analysis Generated

Aug 25, 2026 - 16:10 vuln.today

CVE Published

Aug 25, 2026 - 15:25 cve.org

CRITICAL 9.8

DescriptionCVE.org

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy's parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because parse_expr() calls Python's eval() with built-ins available, an attacker who can cause a downstream caller to pass untrusted input to this public library function can use Python import functionality to execute arbitrary operating-system commands as the qwed-mcp process user, read or modify accessible data, exfiltrate process secrets, or reach internal services. The default MCP tool registry does not expose verify_math_expression(), so exploitation requires a downstream integration that invokes the library API with attacker-controlled input. This issue is fixed in version 0.2.1.

Articles & Coverage 1

News Critical Arbitrary Code Execution in QWED-MCP via SymPy parse_expr() - CVE-2026-55546 Aug 25, 2026

AnalysisAI

Arbitrary code execution in QWED-MCP before 0.2.1 stems from its verify_math_expression() library function feeding attacker-controlled expression and claimed_result strings into SymPy's parse_expr() with an unrestricted built-in namespace, turning a math-verification routine into a Python eval() sink. Any downstream integration that forwards untrusted input to this public API lets an attacker run OS commands as the qwed-mcp process user (root-level RCE confirmed in a container by the vendor advisory). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a downstream integration or caller that invokes the public verify_math_expression() library API (in src/qwed_mcp/engines/math_engine.py) with attacker-controlled 'expression' or 'claimed_result' strings - the default MCP tool registry does NOT register this function, so an out-of-the-box qwed-mcp server is not directly exploitable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, 9.8) describes the worst case where the function is directly reachable with untrusted network input, and the impact is genuine full RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: 0.2.1 - upgrade the qwed-mcp package to 0.2.1 or later (pip install --upgrade 'qwed-mcp>=0.2.1'), which is the primary and complete fix per the vendor advisory and PR #22 (https://github.com/QWED-AI/qwed-mcp/pull/22, commit 362e618). … Detailed patch versions, workarounds, and compensating controls in full report.