qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

Summary

verify_math_expression() in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parse_expr() without restricting global_dict or validating the expression's AST. Because parse_expr() internally calls eval() and Python automatically injects the current module's __builtins__ when no explicit restriction is set, an attacker can embed arbitrary Python expressions — including __import__('os').system(...) — to execute OS commands in the context of the running process. Confirmed exploitation in a Docker container yields root-level arbitrary command execution with no authentication or special configuration required.

Details

The vulnerability resides in src/qwed_mcp/engines/math_engine.py. The public function verify_math_expression(expression, claimed_result, operation) accepts both the expression and claimed_result arguments as raw strings and passes them — after a trivial ^ → ** substitution — to sympy.parsing.sympy_parser.parse_expr():

# math_engine.py:50-54
expr = parse_expr(
    expression.replace("^", "**"),
    local_dict={"x": x, "y": y, "z": z, "pi": pi, "e": E},
    transformations=transformations
)