PT-2026-81397

Name of the Vulnerable Software and Affected Versions QWED versions prior to 5.1.2 Description Authenticated users can execute arbitrary Python code within the API server process because the qwed package passes user-controlled math expressions to the SymPy parse expr function without restricting...

PT-2026-81349

Name of the Vulnerable Software and Affected Versions QWED-MCP versions prior to 0.2.1 Description The verify math expression function in src/qwed mcp/engines/math engine.py passes the expression and claimed result strings directly to SymPy's parse expr function. The implementation only normalize...