AIKIDO-2026-920870

TL;DR

The verify_math_expression MCP tool parses user-supplied mathematical expressions through SymPy's expression parser inside a sandbox that relies on a regex denylist and restricted builtins. Externally supplied input can bypass it with string concatenation and untracked methods such as __getattribute__, then pivot through function objects that still expose their __globals__ to reach os.system. This lets an unauthenticated caller execute arbitrary commands on the host running the server. The fix validates the parsed AST against an allowlist, rejects string and bytes constants and attribute traversal, and normalizes input before parsing.