CVE-2026-55585: QWED AI Verification RCE Vulnerability

CVE-2026-55585 Overview

CVE-2026-55585 is a code injection vulnerability [CWE-94] in QWED, an open-source AI verification infrastructure used to validate large language model (LLM) outputs, tool calls, schemas, and agent state. Versions prior to 5.1.2 pass caller-controlled math expressions directly to SymPy's parse_expr() without restricted global_dict and local_dict namespaces. This allows Python's eval() to resolve builtins and execute arbitrary code in the API server process. Any authenticated tenant, including self-registered accounts, can reach the vulnerable endpoints. The issue is fixed in version 5.1.2.

Critical Impact
Any tenant with an API key can execute arbitrary Python code in the QWED API server, read or write files, run operating system commands, terminate the service, and compromise other tenants sharing the deployment.

Affected Products

QWED (qwed package) versions prior to 5.1.2
Deployments exposing POST /verify/math
Deployments exposing POST /verify/batch with VerificationType.MATH items

Discovery Timeline

2026-08-25 - CVE-2026-55585 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55585

Vulnerability Analysis

The QWED API server exposes two math verification paths that accept expressions from authenticated tenants. In src/qwed_new/api/main.py, the POST /verify/math route is protected by get_current_tenant but accepts any valid tenant API key. It reads the expression field, applies only a cosmetic re.sub(r'(\d)(\()', r'\1*\2', expression) normalization, and hands the result to parse_expr().

In src/qwed_new/core/batch.py, POST /verify/batch routes math items through batch_service.create_job(), stores item.query verbatim, and _verify_item() passes the string to parse_expr() without sanitization. The default-enabled POST /auth/signup endpoint allows anyone to create a standard tenant account, and POST /auth/api-keys issues an x-api-key. Either path then yields arbitrary code execution.

Root Cause

SymPy's parse_expr() invokes Python eval() internally. Without explicit global_dict={} and local_dict={} restrictions, the parser resolves Python builtins, allowing an attacker to reach __import__, open, os.system, and other primitives through crafted expression strings. QWED omitted these restrictions on both math verification code paths.

Attack Vector

An attacker registers a tenant through POST /auth/signup, issues an API key via POST /auth/api-keys, and then submits a malicious expression to POST /verify/math or POST /verify/batch. The expression is parsed server-side, resolving builtins to run arbitrary Python. This yields file read and write, data modification, operating system command execution, service termination, and lateral movement across tenants in shared deployments.

python

# Vulnerable pattern (pre-5.1.2) vs. patched replacement
# Source: https://github.com/QWED-AI/qwed-verification/commit/dc9d4db72ca4b4ae3f96d0e6a0c27a9e38a06f61

# In src/qwed_new/core/batch.py
elif item.verification_type == VerificationType.MATH:
-    from sympy.parsing.sympy_parser import parse_expr
+    from qwed_new.core.safe_parser import safe_parse_expr
    from sympy import simplify

    expression = item.query
    if "=" in expression:
        left, right = expression.split("=", 1)
-        left_expr = parse_expr(left)
-        right_expr = parse_expr(right)
+        left_expr = safe_parse_expr(left)
+        right_expr = safe_parse_expr(right)
        diff = simplify(left_expr - right_expr)
        is_valid = diff == 0

The patch replaces every direct parse_expr() call in src/qwed_new/api/main.py and src/qwed_new/core/batch.py with safe_parse_expr from qwed_new.core.safe_parser, which restricts the SymPy parser namespace.

Detection Methods for CVE-2026-55585

Indicators of Compromise

Requests to POST /verify/math or POST /verify/batch containing Python dunder attributes such as __import__, __builtins__, __class__, or __subclasses__ inside the expression or query fields.
New tenant accounts created through POST /auth/signup followed shortly by POST /auth/api-keys and immediate calls to the math verification endpoints.
Unexpected child processes spawned by the QWED API server, such as /bin/sh, python, curl, or wget.
Outbound network connections or file system writes originating from the QWED service account.

Detection Strategies

Inspect application logs for math verification requests whose payloads contain non-arithmetic tokens, quotes, parentheses around identifiers, or attribute access chains.
Compare signup and api-keys request rates against a known baseline to flag automated tenant enrollment.
Use runtime application self-protection or eBPF-based process monitoring to alert when the QWED process executes shell binaries or reads sensitive files.

Monitoring Recommendations

Forward QWED API access logs and host process telemetry to a centralized analytics platform for correlation.
Alert on any invocation of os.system, subprocess, or socket originating from the QWED interpreter after receiving a /verify/math request.
Track tenant creation, API key issuance, and verification activity per source IP to identify abuse patterns.

How to Mitigate CVE-2026-55585

Immediate Actions Required

Upgrade the qwed package to version 5.1.2, which routes math parsing through safe_parse_expr.
Disable or gate the POST /auth/signup endpoint if self-service tenant registration is not required.
Rotate all tenant API keys issued before the upgrade and audit recent /verify/math and /verify/batch activity.
Isolate the QWED service account with least-privilege file system and network policies until patched.

Patch Information

The fix is delivered in QWED 5.1.2. Relevant references include the GitHub Security Advisory GHSA-q27q-98j4-9pfv, Pull Request #200, and the remediation commits 6066b68 and dc9d4db. Both commits replace direct SymPy parse_expr() calls with the restricted safe_parse_expr helper.

Workarounds

Block or authenticate POST /auth/signup behind an administrator approval workflow.
Place the QWED API server behind a web application firewall rule that rejects math payloads containing __, import, open, or backticks.
Run the QWED process in a hardened container with read-only file system, no shell, and egress network restrictions until 5.1.2 can be deployed.

bash

# Upgrade QWED to the patched release
pip install --upgrade 'qwed>=5.1.2'

# Verify the installed version
python -c "import qwed_new, importlib.metadata; print(importlib.metadata.version('qwed'))"