CVE-2026-55546

### Summary `verify_math_expression()` in `qwed-mcp` v0.2.0 passes attacker-controlled strings directly to SymPy's `parse_expr()` without restricting `global_dict` or validating the expression's AST. Because `parse_expr()` internally calls `eval()` and Python automatically injects the current module's `__builtins__` when no explicit restriction is set, an attacker can embed arbitrary Python expressions — including `__import__('os').system(...)` — to execute OS commands in the context of the running process. Confirmed exploitation in a Docker container yields root-level arbitrary command execution with no authentication or special configuration required. ### Details The vulnerability resides in `src/qwed_mcp/engines/math_engine.py`. The public function `verify_math_expression(expression, claimed_result, operation)` accepts both the `expression` and `claimed_result` arguments as raw strings and passes them — after a trivial `^` → `**` substitution — to `sympy.parsing.sympy_parser.parse_expr()`: ```python # math_engine.py:50-54 expr = parse_expr( expression.replace("^", "**"), local_dict={"x": x, "y": y, "z": z, "pi": pi, "e": E}, transformations=transformations ) ``` ```python # math_engine.py:64-68 claimed = parse_expr( claimed_result.replace("^", "**"), local_dict={"x": x, "y": y, "z": z, "pi": pi, "e": E}, transformations=transformations ) ``` `local_dict` only adds math symbols to the evaluation namespace; it does **not** remove `__builtins__`. SymPy's `parse_expr()` eventually calls Python's built-in `eval()`, which — absent an explicit `{"__builtins__": {}}` in `global_dict` — receives the full built-in namespace. This makes `__import__`, `open`, `exec`, and every other Python built-in available to the evaluated expression. There is no allowlist, AST pre-validation, or sandboxing applied at any point before the `parse_expr()` calls (lines 50 and 64). Data flow: 1. **Source** — `math_engine.py:13-16`: external caller supplies `exp