CVE-2026-55546

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verifymathexpression in src/qwedmcp/engines/mathengine.py passes attacker-controlled expression and claimedresult strings directly to SymPy's parseexpr after only normalizing caret syntax to Python exponent syntax, without...

GHSA-MW6R-2HVM-4RP2 qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

Summary verifymathexpression in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parseexpr without restricting globaldict or validating the expression's AST. Because parseexpr internally calls eval and Python automatically injects the current module's builtins when no explic...

CVE-2026-55546 QWED-MCP: Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verifymathexpression in src/qwedmcp/engines/mathengine.py passes attacker-controlled expression and claimedresult strings directly to SymPy's parseexpr after only normalizing caret syntax to Python exponent syntax, without...

PHPUnit-GoScan

🛡️ PHPUnit Go Scanner CVE-2017-9841 Ein schneller, in Go geschriebener Multithread-Scanner zur Erkennung exponierter und verwundbarer eval-stdin.php-Endpunkte in PHPUnit CVE-2017-9841. Unterstützt das Scannen mehrerer Domains mit paralleler Ausführung und automatischer Protokollerkennung. 🖼...

PT-2026-81349

Name of the Vulnerable Software and Affected Versions QWED-MCP versions prior to 0.2.1 Description The verify math expression function in src/qwed mcp/engines/math engine.py passes the expression and claimed result strings directly to SymPy's parse expr function. The implementation only normalize...

CVE-2026-78136

A flaw was found in CHIRP from chirpmyradio. A local attacker can achieve arbitrary code execution by tricking a user into processing a specially crafted Comma Separated Values CSV file. This vulnerability, an eval injection, occurs within the cleantmode function when handling CSV data, leading t...

Astra Linux – Vulnerability in node-thenify

This affects the thenify package before version 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this value is passed to the eval function without any sanitization...

Astra Linux – Vulnerability in pillow

Pillow through 10.1.0 allows for arbitrary code execution via the environment parameter. This is a different vulnerability than CVE-2022-22817, which involved the expression parameter...

CVE-2026-78136

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...

CVE-2026-78136

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...

CVE-2026-78136

chirpmyradio CHIRP (a radio programming tool) is vulnerable to eval injection via crafted CSV data in the _clean_tmode function within drivers/kenwood_itm.py. This flaw allows arbitrary code execution when a user opens a maliciously crafted CSV file, as indicated by the associated research reposi...

CVE-2026-78136

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...

CVE-2026-78136

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...

EUVD-2026-64616

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...

PT-2026-79749

Name of the Vulnerable Software and Affected Versions chirpmyradio CHIRP versions prior to 39178db Description An eval injection issue exists when processing crafted CSV data. This occurs within the clean tmode function located in the drivers/kenwood itm.py file. Eval injection is a flaw where an...

CVE-2026-61539

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

GHSA-X2RJ-828P-HX9M Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Summary Xinference used Python's unsafe eval function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts that cause the model to...

Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Summary Xinference used Python's unsafe eval function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts that cause the model to...

EUVD-2026-64146

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

CVE-2026-61539 Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...