QWED-MCP, a deterministic verification gateway, includes a function that forwards attacker-controlled math expressions directly to SymPy’s parse_expr without restricting Python built‑ins or validating the expression’s abstract syntax tree. Because parse_expr internally uses eval with built‑ins available, an adversary can craft an expression containing Python import statements to execute arbitrary operating‑system commands, read or modify data accessible to the qwed-mcp process, exfiltrate secrets, or reach internal services. The vulnerability is therefore a high‑impact remote code execution flaw.

Vulnerable builds of QWED‑MCP, specifically any release before v0.2.1, on any environment that exposes verify_math_expression to external input. The product is distributed by QWED‑AI as"QWED‑MCP". The default MCP tool registry does not expose the vulnerable function, so penetration requires a downstream integration that calls the library through the verify_math_expression API.

The CVSS score of 9.8 marks this issue as critical. The EPSS score is not available, and it is not yet listed in CISA’s KEV catalog, implying the market exploitation risk is currently undefined but the technical severity remains high. Exploitation requires that a caller can supply untrusted input to the public API; thus an attacker can trigger the vulnerability through any integration that invokes verify_math_expression with attacker-controlled data. Given the absence of additional mitigating controls, the likelihood of successful exploitation is significant in environments where untrusted inputs reach this function.