CVE-2026-55546 QWED-MCP: Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
Attackers can execute arbitrary code via unsanitized input in QWED-MCP's math verification function if integrated by downstream applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55546?
CVE-2026-55546 is a critical code injection vulnerability in QWED-AI qwed-mcp, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy's parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because parse_expr() calls Python's eval() with built-ins available, an attacker who can cause a downstream caller to pass untrusted input to this public library function can use Python import functionality to execute arbitrary operating-system commands as the qwed-mcp process user, read or modify accessible data, exfiltrate process secrets, or reach internal services. The default MCP tool registry does not expose verify_math_expression(), so exploitation requires a downstream integration that invokes the library API with attacker-controlled input. This issue is fixed in version 0.2.1.
Weakness: CWE-94
Which versions are affected by CVE-2026-55546?
3 open source packages ship an affected version, including qwed-mcp.
| Package | Affected | Fixed in |
|---|---|---|
qwed-mcp PyPI | All versions | 0.2.1 |
qwed-mcp PyPI | All versions | 0.2.1 |
qwed-mcp PyPI | All versions | 0.2.1 |
How do I fix CVE-2026-55546?
Upgrade qwed-mcp to 0.2.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-55546 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55546 exists.
Sources
Also known as GHSA-mw6r-2hvm-4rp2, PYSEC-2026-3915.