CVE-2026-55585

### Summary The `qwed` package (version 5.1.1) passes attacker-controlled input directly to SymPy's `parse_expr()` function without a restricted namespace. Because `parse_expr()` internally calls Python's `eval()`, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack requires only a standard user account, which is freely obtainable through the default-enabled `/auth/signup` endpoint. Successful exploitation gives the attacker full read/write access to the filesystem and the ability to execute operating system commands, resulting in complete server compromise. ### Details The vulnerability exists in two independently reachable code paths: **Primary sink — `POST /verify/math`** `src/qwed_new/api/main.py:442` defines the `/verify/math` route, protected only by `get_current_tenant` (line 444), which accepts any valid tenant API key. The request body field `expression` is read at line 463 and passed through a cosmetic regex normalization at line 495 (`re.sub(r'(\d)(\()', r'\1*\2', expression)`) that performs no security validation. The normalized string is then passed directly to `parse_expr()` at line 504: ```python # src/qwed_new/api/main.py expression = request.get("expression") ... expression_normalized = re.sub(r'(\d)(\()', r'\1*\2', expression) ... parsed = parse_expr(expression_normalized) # line 504 — unsandboxed eval ``` **Secondary sink — `POST /verify/batch`** `src/qwed_new/api/main.py:1481` defines the `/verify/batch` route. Batch items flow through `batch_service.create_job()` (line 1517) into `batch.py:132` where `item.query` is stored verbatim, then processed by `_verify_item()` (line 167). When the item type is `VerificationType.MATH` (line 222), the expression is passed to `parse_expr()` at line 239 with no sanitization: ```python # src/qwed_new/core/batch.py expression = item.query ... parsed = parse_expr(expression) # line 239 — unsandboxed eval ``` `parse_expr()` accepts a `globa