CVE-2026-55546: QWED-MCP Remote Code Execution Vulnerability

CVE-2026-55546 Overview

CVE-2026-55546 is a code injection vulnerability [CWE-94] in QWED-MCP, a deterministic verification gateway for the Model Context Protocol (MCP). The flaw exists in verify_math_expression() within src/qwed_mcp/engines/math_engine.py. The function forwards attacker-controlled expression and claimed_result strings to SymPy's parse_expr() without restricting global_dict, removing Python built-ins, or validating the resulting abstract syntax tree (AST). Because parse_expr() invokes Python's eval() with built-ins available, attackers can achieve arbitrary command execution. The maintainers fixed the issue in version 0.2.1.

Critical Impact
An attacker who can reach a downstream integration that passes untrusted input to verify_math_expression() can execute arbitrary operating-system commands as the qwed-mcp process user, exfiltrate secrets, and pivot to internal services.

Affected Products

QWED-MCP versions prior to 0.2.1
Downstream MCP integrations exposing verify_math_expression() to untrusted input
Python environments where the qwed-mcp library API is invoked with attacker-controlled expressions

Discovery Timeline

2026-08-25 - CVE-2026-55546 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55546

Vulnerability Analysis

The vulnerability originates in QWED-MCP's math verification engine. The verify_math_expression() function normalizes caret (^) notation into Python exponent (**) syntax, then passes the raw string to sympy.parsing.sympy_parser.parse_expr(). SymPy's parser internally calls Python's eval() on the transformed AST. When no global_dict is provided and built-ins are not stripped, evaluation occurs in a namespace where __import__, __builtins__, and object introspection primitives remain accessible. An attacker can craft an expression that resolves to __import__('os').system(...) or equivalent constructs, yielding arbitrary code execution under the qwed-mcp process account.

Root Cause

The root cause is untrusted input flowing into a Python code evaluator without an allowlist. parse_expr() is documented as unsafe for adversarial input, yet the QWED-MCP wrapper omitted the mitigations required for safe use: no restricted global_dict, no local_dict, no removal of Python built-ins, and no AST inspection to reject dangerous nodes such as Call, Attribute, or Name references to import machinery.

Attack Vector

Exploitation is remote and requires no authentication or user interaction. The default MCP tool registry does not expose verify_math_expression(), so an attacker must reach the library through a downstream integration that passes untrusted input to the public API. Once reachable, a single crafted expression achieves code execution, filesystem access, and outbound network reach from the compromised process.

python

# Patched safe parser wrapper introduced in v0.2.1
# Source: https://github.com/QWED-AI/qwed-mcp/commit/362e61892052e250c56cb1ee852024d6f98c467b
"""
Safe SymPy expression parser for QWED-MCP.

Wraps sympy.parsing.sympy_parser.parse_expr with input validation,
a denylist for dangerous constructs, and a restricted evaluation
namespace.  This module is the ONLY approved entry point for parsing
user-supplied math expressions.

Security fix for GHSA-mw6r-2hvm-4rp2 (CWE-94).
"""

import re
from typing import Any, Dict, Optional, Tuple

import sympy
from sympy import (
    E, I, Integer, Float, Rational, Symbol, oo, pi,
)
from sympy.parsing.sympy_parser import (
    parse_expr,
    standard_transformations,
    implicit_multiplication_application,
    convert_xor,
)

__all__ = ["safe_parse_expr", "SafeParserError"]

MAX_EXPRESSION_LENGTH = 5_000

Source: GitHub Commit 362e618

Detection Methods for CVE-2026-55546

Indicators of Compromise

Unexpected child processes spawned by the qwed-mcp Python interpreter, particularly shells (sh, bash) or system utilities (curl, wget, nc).
Outbound network connections from the qwed-mcp process to unfamiliar hosts or cloud metadata endpoints such as 169.254.169.254.
Log entries showing verify_math_expression() invocations containing tokens such as __import__, __builtins__, getattr, eval, or compile.

Detection Strategies

Inspect application logs for math expressions containing Python dunder attributes or attribute chains that would be rejected by the v0.2.1 denylist.
Instrument the qwed-mcp process with runtime security tooling to alert on unexpected execve or fork events.
Static-scan downstream projects to identify callers that pass user-supplied strings into qwed_mcp.engines.math_engine.verify_math_expression.

Monitoring Recommendations

Monitor Python interpreter processes for anomalous system calls, file writes outside working directories, and new listening sockets.
Collect and centralize MCP tool invocation logs for retrospective search against known exploitation patterns.
Alert on egress traffic from math verification workloads that were previously network-idle.

How to Mitigate CVE-2026-55546

Immediate Actions Required

Upgrade QWED-MCP to version 0.2.1 or later across all deployments.
Audit downstream integrations that call verify_math_expression() and confirm no path forwards untrusted input.
Rotate any credentials, tokens, or API keys accessible to the qwed-mcp process if exploitation cannot be ruled out.

Patch Information

The fix is delivered in GitHub Release v0.2.1 via GitHub Pull Request #22 and commit 362e618. The patch introduces a dedicated safe_parser module that enforces a maximum expression length, applies a regex denylist for dangerous constructs, and constrains SymPy evaluation to an allowlisted namespace. See the GitHub Security Advisory GHSA-mw6r-2hvm-4rp2 for advisory details.

Workarounds

If upgrading immediately is not feasible, wrap calls to verify_math_expression() with strict input validation that rejects any non-mathematical characters.
Run the qwed-mcp process under a least-privileged service account with no network egress to sensitive internal services.
Isolate the workload inside a container or sandbox that blocks execution of shells and package managers.

bash

# Upgrade qwed-mcp to the patched release
pip install --upgrade "qwed-mcp>=0.2.1"

# Verify installed version
python -c "import qwed_mcp, importlib.metadata as m; print(m.version('qwed-mcp'))"