Remote Code Execution in qwed-mcp via Unsafe SymPy Input

The qwed-mcp library, specifically version 0.2.0, contains a critical security vulnerability in the verify_math_expression function located in src/qwed_mcp/engines/math_engine.py. The function accepts raw string input for mathematical expressions and forwards them to sympy.parsing.sympy_parser.parse_expr() without proper sanitization or namespace restriction.

Internally, SymPy's parse_expr() utilizes the Python eval() function. Because the library fails to restrict the global namespace or define an empty __builtins__ dictionary, the evaluation process inherits the current module's full built-in scope. This allows an attacker to inject and execute arbitrary Python expressions, including __import__('os').system(). This vulnerability facilitates full remote code execution in the context of the running process with the privileges of the executing user, as confirmed by successful exploitation experiments in a standard Python Docker container.

Attack Chain

1. An attacker identifies a service or application utilizing qwed-mcp that allows submission of arbitrary mathematical expressions to the verify_math_expression function.
2. The attacker crafts a malicious Python payload (e.g., __import__('os').system('command')) designed to escape the expected mathematical evaluation context.
3. The target application receives the payload and passes it as the expression or claimed_result argument to qwed_mcp.engines.math_engine.verify_math_expression.
4. verify_math_expression performs basic string replacement (^ to **) and forwards the unsanitized string to sympy.parsing.sympy_parser.parse_expr.
5. parse_expr invokes Python's eval() function using the unrestricted module namespace, which includes access to os and other powerful modules via __builtins__.
6. The os.system() payload executes the specified OS commands with the permissions of the application process.
7. The attacker achieves persistent access or exfiltration by redirecting output to temporary files or establishing outbound C2 communication.

Impact

Successful exploitation allows an attacker to achieve full remote code execution on the host machine or container running the qwed-mcp library. This grants the attacker the ability to read, modify, or delete files, exfiltrate sensitive environment variables and credentials, and pivot into the internal network. Because the vulnerability is directly accessible via the library's API, any application integrating qwed-mcp that exposes this function to external input is at immediate risk of total system compromise.

Recommendation

• Immediately upgrade to a patched version of qwed-mcp if available, or apply the remediation patch provided in the advisory to math_engine.py.
• Update math_engine.py to implement strict AST pre-validation using the ast module to ensure only safe mathematical constructs are processed.
• Explicitly set global_dict={"__builtins__": {}} in all calls to parse_expr() to eliminate the possibility of accessing sensitive built-in functions during evaluation.
• Audit applications utilizing qwed-mcp to ensure no user-controlled input reaches the verify_math_expression function without secondary validation.