Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
The flaw scored 9.8 on the CVE scale, traced to an unrestricted call to SymPy's parse_expr(), and is fixed in version 0.2.1.
Why now: The fix for this is already out in version 0.2.1, so the open question is how many MCP deployments still run the vulnerable build.
QWED-MCP's verification gateway passed attacker-controlled math expressions straight to SymPy's parser, opening remote code execution rated 9.8 out of 10, per the CVE advisory. The function it runs, verify_math_expression(), is the check other tools call to confirm an AI model's math before acting on it. Any agent or workflow that leaned on QWED-MCP to sanity-check a model's arithmetic was trusting code execution instead of a checked number.
The code normalizes caret syntax in the input, then hands the expression and the claimed result to SymPy's parse_expr(). There's no global_dict restriction, no builtins removal, and no AST validation on either value. SymPy's parser isn't a sandbox. It evaluates Python-like syntax by design, so untrusted input reaches it the same way untrusted input reaches eval().
QWED-MCP fixed the hole in 0.2.1. The advisory doesn't say how long the earlier builds were live, or whether anyone exploited the gap before the patch went out. Deployments that haven't upgraded are still carrying it.
Each link below shares sources, entities, or timing with this story.
Claude Code uses MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover CVE, MCP; reported by the same outlet (github.com).
Google released MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Google released MCP); both cover CVE, MCP; overlapping topics (execution, gateway).
Claude Code uses MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover AST, MCP; reported by the same outlet (github.com).
Linked by a graph relationship (Claude Code uses MCP); both cover AST, MCP; reported by the same outlet (github.com).
Google released MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Google released MCP); both cover CVE, Fixed; overlapping topics (attacker, call).
Windsurf uses MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Windsurf uses MCP); both cover CVE, GHSA; reported by the same outlet (github.com).
Codex uses MCP / Shared entity: MCP / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Codex uses MCP); both cover MCP; reported by the same outlet (github.com).
Cursor uses MCP / Shared entity: MCP / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Cursor uses MCP); both cover MCP; reported by the same outlet (github.com).