{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/qwed-ai/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["qwed-mcp (0.2.0)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","python","injection","supply-chain"],"_cs_type":"advisory","_cs_vendors":["QWED-AI"],"content_html":"\u003cp\u003eThe qwed-mcp library, specifically version 0.2.0, contains a critical security vulnerability in the \u003ccode\u003everify_math_expression\u003c/code\u003e function located in \u003ccode\u003esrc/qwed_mcp/engines/math_engine.py\u003c/code\u003e. The function accepts raw string input for mathematical expressions and forwards them to \u003ccode\u003esympy.parsing.sympy_parser.parse_expr()\u003c/code\u003e without proper sanitization or namespace restriction.\u003c/p\u003e\n\u003cp\u003eInternally, SymPy's \u003ccode\u003eparse_expr()\u003c/code\u003e utilizes the Python \u003ccode\u003eeval()\u003c/code\u003e function. Because the library fails to restrict the global namespace or define an empty \u003ccode\u003e__builtins__\u003c/code\u003e dictionary, the evaluation process inherits the current module's full built-in scope. This allows an attacker to inject and execute arbitrary Python expressions, including \u003ccode\u003e__import__('os').system()\u003c/code\u003e. This vulnerability facilitates full remote code execution in the context of the running process with the privileges of the executing user, as confirmed by successful exploitation experiments in a standard Python Docker container.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a service or application utilizing \u003ccode\u003eqwed-mcp\u003c/code\u003e that allows submission of arbitrary mathematical expressions to the \u003ccode\u003everify_math_expression\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious Python payload (e.g., \u003ccode\u003e__import__('os').system('command')\u003c/code\u003e) designed to escape the expected mathematical evaluation context.\u003c/li\u003e\n\u003cli\u003eThe target application receives the payload and passes it as the \u003ccode\u003eexpression\u003c/code\u003e or \u003ccode\u003eclaimed_result\u003c/code\u003e argument to \u003ccode\u003eqwed_mcp.engines.math_engine.verify_math_expression\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003everify_math_expression\u003c/code\u003e performs basic string replacement (\u003ccode\u003e^\u003c/code\u003e to \u003ccode\u003e**\u003c/code\u003e) and forwards the unsanitized string to \u003ccode\u003esympy.parsing.sympy_parser.parse_expr\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eparse_expr\u003c/code\u003e invokes Python's \u003ccode\u003eeval()\u003c/code\u003e function using the unrestricted module namespace, which includes access to \u003ccode\u003eos\u003c/code\u003e and other powerful modules via \u003ccode\u003e__builtins__\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eos.system()\u003c/code\u003e payload executes the specified OS commands with the permissions of the application process.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves persistent access or exfiltration by redirecting output to temporary files or establishing outbound C2 communication.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to achieve full remote code execution on the host machine or container running the \u003ccode\u003eqwed-mcp\u003c/code\u003e library. This grants the attacker the ability to read, modify, or delete files, exfiltrate sensitive environment variables and credentials, and pivot into the internal network. Because the vulnerability is directly accessible via the library's API, any application integrating \u003ccode\u003eqwed-mcp\u003c/code\u003e that exposes this function to external input is at immediate risk of total system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade to a patched version of \u003ccode\u003eqwed-mcp\u003c/code\u003e if available, or apply the remediation patch provided in the advisory to \u003ccode\u003emath_engine.py\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003emath_engine.py\u003c/code\u003e to implement strict AST pre-validation using the \u003ccode\u003east\u003c/code\u003e module to ensure only safe mathematical constructs are processed.\u003c/li\u003e\n\u003cli\u003eExplicitly set \u003ccode\u003eglobal_dict={\u0026quot;__builtins__\u0026quot;: {}}\u003c/code\u003e in all calls to \u003ccode\u003eparse_expr()\u003c/code\u003e to eliminate the possibility of accessing sensitive built-in functions during evaluation.\u003c/li\u003e\n\u003cli\u003eAudit applications utilizing \u003ccode\u003eqwed-mcp\u003c/code\u003e to ensure no user-controlled input reaches the \u003ccode\u003everify_math_expression\u003c/code\u003e function without secondary validation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-25T16:01:38Z","date_published":"2026-08-25T16:01:38Z","id":"https://feed.craftedsignal.io/briefs/2026-08-qwed-mcp-rce/","summary":"The qwed-mcp library v0.2.0 is vulnerable to arbitrary remote code execution because it passes unsanitized input to SymPy's parse_expr function, allowing attackers to execute arbitrary system commands via Python code injection.","title":"Remote Code Execution in qwed-mcp via Unsafe SymPy Input","url":"https://feed.craftedsignal.io/briefs/2026-08-qwed-mcp-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - QWED-AI","version":"https://jsonfeed.org/version/1.1"}