QWED-MCP's verification gateway let attackers execute code

QWED-MCP's verification gateway passed attacker-controlled math expressions straight to SymPy's parser, opening remote code execution rated 9.8 out of 10, per the CVE advisory. The function it runs, verify_math_expression(), is the check other tools call to confirm an AI model's math before acting on it. Any agent or workflow that leaned on QWED-MCP to sanity-check a model's arithmetic was trusting code execution instead of a checked number.

The code normalizes caret syntax in the input, then hands the expression and the claimed result to SymPy's parse_expr(). There's no global_dict restriction, no builtins removal, and no AST validation on either value. SymPy's parser isn't a sandbox. It evaluates Python-like syntax by design, so untrusted input reaches it the same way untrusted input reaches eval().

QWED-MCP fixed the hole in 0.2.1. The advisory doesn't say how long the earlier builds were live, or whether anyone exploited the gap before the patch went out. Deployments that haven't upgraded are still carrying it.