qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
verify_math_expression() in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parse_expr() without restricting global_dict or validating the expression's AST. Because parse_expr() internally calls eval() and Python automatically injects the current module's builtins when no explicit restriction is set, an attacker can embed arbitrary Python expressions — including import('os').system(…) — to execute OS commands in the context of the running process. Confirmed exploitation in a Docker container yields root-level arbitrary command …