CVE-2026-55585

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parseexpr() without restricted globaldict and localdict namespaces, allowing Python eval() to resolve builtins and execute arbitrary Python code in the API server process. In src/qwednew/api/main.py, POST /verify/math is protected by getcurrenttenant but accepts any valid tenant API key, reads the expression field, applies only a cosmetic re.sub(r'(\d)(()', r'\1*\2', expression) normalization, and passes the result to parseexpr(). In src/qwednew/core/batch.py, POST /verify/batch sends math items through batchservice.createjob(), stores item.query verbatim, and verifyitem() passes VerificationType.MATH input to parse_expr() without sanitization. The default-enabled POST /auth/signup endpoint allows anyone to create a standard tenant account, POST /auth/api-keys issues an x-api-key, and either vulnerable path can then be used to read or write files, modify data, execute operating system commands, terminate the service, and compromise other tenants in a shared deployment. This issue is fixed in version 5.1.2.