qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

QFinch assessment

verifymathexpression() in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parseexpr() without restricting globaldict or validating the expression's AST. Because parseexpr() internally calls eval() and Python automatically injects the current module's builtins when no explicit restriction is set, an attacker can embed arbitrary Python expressions — including import('os').system(...) — to execute OS commands in the context of the running process. Confirmed exploitation in a Docker container yields root-level arbitrary command execution with no authentication or special configuration required.

Potential impact

Any caller that passes attacker-controlled input to verifymathexpression() or any future MCP tool registration that exposes this function over a network interface is fully compromised. An attacker can: - Execute arbitrary OS commands as the process user (demonstrated as root in Phase 2). - Read, write, or delete files accessible to the process. - Exfiltrate secrets (API keys, environment variables, credentials) from the process environment. - Pivot to internal services reachable from the host. The function is part of the public PyPI package qwed-mcp. Any downstream library consumer or service that wraps verifymathexpression() with user-supplied input is affected without additional configuration. While v0.2.0's default MCP tool registry does not expose this function as a registered tool, the library API is directly importable and exploitable by any code that calls it.

Technical context

The vulnerability resides in src/qwedmcp/engines/mathengine.py. The public function verifymathexpression(expression, claimedresult, operation) accepts both the expression and claimedresult arguments as raw strings and passes them — after a trivial ^ → substitution — to sympy.parsing.sympyparser.parseexpr(): localdict only adds math symbols to the evaluation namespace; it does not remove builtins. SymPy's parseexpr() eventually calls Python's built-in eval(), which — absent an explicit {"builtins": {}} in globaldict — receives the full built-in namespace. This makes import, open, exec, and every other Python built-in available to the evaluated expression. There is no allowlist, AST pre-validation, or sandboxing applied at any point before the parseexpr() calls (lines 50 and 64). Data flow: 1. Source — mathengine.py:13-16: external caller supplies expression and claimedresult. 2. Propagation — mathengine.py:50-54: expression substituted and forwarded to parseexpr(). 3. Propagation — mathengine.py:64-68: claimedresult substituted and forwarded to parseexpr(). 4. Sink — sympy.parsing.sympyparser.parseexpr(): calls eval() with unrestricted builtins.