Qwed Mcp
Monthly
Arbitrary code execution in QWED-MCP before 0.2.1 stems from its verify_math_expression() library function feeding attacker-controlled expression and claimed_result strings into SymPy's parse_expr() with an unrestricted built-in namespace, turning a math-verification routine into a Python eval() sink. Any downstream integration that forwards untrusted input to this public API lets an attacker run OS commands as the qwed-mcp process user (root-level RCE confirmed in a container by the vendor advisory). Publicly available exploit code exists via the GHSA advisory PoC, but this is not listed in CISA KEV; the published CVSS is 9.8 while real reach depends on how the library is wired up.
Arbitrary code execution in QWED-MCP before 0.2.1 stems from its verify_math_expression() library function feeding attacker-controlled expression and claimed_result strings into SymPy's parse_expr() with an unrestricted built-in namespace, turning a math-verification routine into a Python eval() sink. Any downstream integration that forwards untrusted input to this public API lets an attacker run OS commands as the qwed-mcp process user (root-level RCE confirmed in a container by the vendor advisory). Publicly available exploit code exists via the GHSA advisory PoC, but this is not listed in CISA KEV; the published CVSS is 9.8 while real reach depends on how the library is wired up.