CVE-2026-55546: CWE-94: Improper Control of Generation of Code ('Code Injection') in QWED-AI qwed-mcp

The vulnerability exists in the verify_math_expression() function of qwed-mcp before version 0.2.1, where attacker-controlled expressions and claimed_result strings are passed directly to SymPy's parse_expr() after minimal normalization. Since parse_expr() internally calls Python's eval() with built-ins available, an attacker can execute arbitrary OS commands, access or modify data, exfiltrate secrets, or reach internal services with the privileges of the qwed-mcp process user. The default MCP tool registry does not expose this function, so exploitation requires a downstream integration that passes untrusted input to this API. The vulnerability is addressed in version 0.2.1.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the host running qwed-mcp, leading to full compromise including confidentiality, integrity, and availability impacts. This includes executing OS commands, reading or modifying accessible data, exfiltrating secrets, or accessing internal services with the permissions of the qwed-mcp process user.

This vulnerability is fixed in qwed-mcp version 0.2.1. Users should upgrade to version 0.2.1 or later. Since the default MCP tool registry does not expose the vulnerable function, ensure that any downstream integrations invoking verify_math_expression() with untrusted input are updated or disabled. Patch status is not explicitly confirmed beyond the fix in 0.2.1; verify with vendor advisory for current remediation guidance.