CVE-2026-55585: CWE-94: Improper Control of Generation of Code ('Code Injection') in QWED-AI qwed-verification

The QWED-AI qwed-verification package versions prior to 5.1.2 contain a code injection vulnerability (CWE-94) due to improper control of code generation. Specifically, the qwed package passes caller-controlled math expressions directly to SymPy's parse_expr() without restricting the global_dict and local_dict namespaces, enabling Python eval() to execute arbitrary code within the API server process. The vulnerable endpoints /verify/math and /verify/batch accept expressions from authenticated tenants with minimal normalization or sanitization. The default-enabled /auth/signup and /auth/api-keys endpoints allow attackers to create tenant accounts and obtain API keys, facilitating exploitation. Successful exploitation can lead to arbitrary code execution, file system access, OS command execution, service termination, and cross-tenant compromise in shared environments. The vulnerability is resolved in version 5.1.2.

An attacker with a valid tenant API key can exploit this vulnerability to execute arbitrary Python code on the API server. This can lead to full compromise of the server process, including reading and writing files, executing operating system commands, terminating the service, and compromising other tenants in a shared deployment environment. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Upgrade to version 5.1.2 or later where this vulnerability is fixed. Until then, restrict access to tenant API keys and disable or secure the /auth/signup and /auth/api-keys endpoints to prevent unauthorized tenant creation and API key issuance. Avoid passing unsanitized user input to SymPy's parse_expr() without restricting namespaces.