{"apiVersion":"1.0","identifier":"CVE-2026-55546","description":"QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy-s parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because parse_expr() calls Python-s eval() with built-ins available, an attacker who can cause a downstream caller to pass untrusted input to this public library function can use Python import functionality to execute arbitrary operating-system commands as the qwed-mcp process user, read or modify accessible data, exfiltrate process secrets, or reach internal services. The default MCP tool registry does not expose verify_math_expression(), so exploitation requires a downstream integration that invokes the library API with attacker-controlled input. This issue is fixed in version 0.2.1.","publishedAt":"2026-08-25T16:16:55","lastModifiedAt":"2026-08-25T19:16:49","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55546","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.0041,"riskScore":1.02,"affectedProduct":"qwed-mcp","affectedVersions":"<0.2.1","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-55546","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-55546","en":"https://www.redsauce.net/en/cves/CVE-2026-55546","fr":"https://www.redsauce.net/fr/cves/CVE-2026-55546","pt":"https://www.redsauce.net/pt/cves/CVE-2026-55546","de":"https://www.redsauce.net/de/cves/CVE-2026-55546","sk":"https://www.redsauce.net/sk/cves/CVE-2026-55546","el":"https://www.redsauce.net/el/cves/CVE-2026-55546"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-55546"}}