Description
QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parse_expr() without restricted global_dict and local_dict namespaces, allowing Python eval() to resolve builtins and execute arbitrary Python code in the API server process. In src/qwed_new/api/main.py, POST /verify/math is protected by get_current_tenant but accepts any valid tenant API key, reads the expression field, applies only a cosmetic re.sub(r'(\d)(()', r'\1*\2', expression) normalization, and passes the result to parse_expr(). In src/qwed_new/core/batch.py, POST /verify/batch sends math items through batch_service.create_job(), stores item.query verbatim, and _verify_item() passes VerificationType.MATH input to parse_expr() without sanitization. The default-enabled POST /auth/signup endpoint allows anyone to create a standard tenant account, POST /auth/api-keys issues an x-api-key, and either vulnerable path can then be used to read or write files, modify data, execute operating system commands, terminate the service, and compromise other tenants in a shared deployment. This issue is fixed in version 5.1.2.
Published: 2026-08-25
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

QWED is an open‑source AI verification platform that, before version 5.1.2, forwarded user‑supplied mathematical expressions directly to SymPy’s parse_expr() without protecting the global or local namespaces. This omission allowed the injected expression to be interpreted by Python’s eval() and to execute arbitrary code with the API server’s privileges. An authenticated tenant user can therefore read or write files, launch OS commands, terminate the service, or compromise other tenants in the same deployment.

Affected Systems

The vulnerability affects installations of the qwed‑verification package provided by QWED‑AI that run any version earlier than 5.1.2. The exposed endpoints include POST /verify/math, POST /verify/batch, and the publicly accessible POST /auth/signup and POST /auth/api-keys routes that enable tenant creation and key issuance.

Risk and Exploitability

The risk is high, with a CVSS score of 8.8 indicating significant impact on confidentiality, integrity, and availability. The EPSS score is currently unavailable, but because the signup flow is unprotected, any network‑reachable user can obtain a valid API key and trigger the vulnerable code paths. The issue is not yet listed in CISA’s KEV catalog, but the combination of front‑end exposure and lack of input validation makes exploitation likely in shared or cloud deployments.

Generated by OpenCVE AI on August 25, 2026 at 17:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the qwed‑verification package to version 5.1.2 or later where parse_expr input is sanitized and tenant creation is restricted.
  • Disable the public /auth/signup endpoint or add strong authentication so that only authorized administrators can create new tenant accounts and issue API keys.
  • Audit and monitor POST /verify/math and POST /verify/batch for abnormal activity; block or rate‑limit requests that contain suspicious mathematical expressions or attempt to execute system commands.
  • Apply network segmentation or firewall rules to isolate tenants and protect the API server, enforcing the principle of least privilege for API keys.

Generated by OpenCVE AI on August 25, 2026 at 17:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-q27q-98j4-9pfv qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`
History

Tue, 25 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Description QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parse_expr() without restricted global_dict and local_dict namespaces, allowing Python eval() to resolve builtins and execute arbitrary Python code in the API server process. In src/qwed_new/api/main.py, POST /verify/math is protected by get_current_tenant but accepts any valid tenant API key, reads the expression field, applies only a cosmetic re.sub(r'(\d)(()', r'\1*\2', expression) normalization, and passes the result to parse_expr(). In src/qwed_new/core/batch.py, POST /verify/batch sends math items through batch_service.create_job(), stores item.query verbatim, and _verify_item() passes VerificationType.MATH input to parse_expr() without sanitization. The default-enabled POST /auth/signup endpoint allows anyone to create a standard tenant account, POST /auth/api-keys issues an x-api-key, and either vulnerable path can then be used to read or write files, modify data, execute operating system commands, terminate the service, and compromise other tenants in a shared deployment. This issue is fixed in version 5.1.2.
Title QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-25T16:23:39.334Z

Reserved: 2026-06-16T23:18:03.169Z

Link: CVE-2026-55585

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-25T17:17:32.903

Modified: 2026-08-25T17:17:32.903

Link: CVE-2026-55585

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T17:30:07Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')