Skip to content

fix(math): restrict sympy expression parsing#200

Merged
Rahul Dass (rahuldass19) merged 8 commits into
QWED-AI:mainfrom
sebastiondev:fix/cwe95-main-sympy-9383
Jun 14, 2026
Merged

fix(math): restrict sympy expression parsing#200
Rahul Dass (rahuldass19) merged 8 commits into
QWED-AI:mainfrom
sebastiondev:fix/cwe95-main-sympy-9383

fix: restrict sympy parse_expr to prevent code execution (CWE-95)

dc9d4db
Select commit
Loading
Failed to load commit list.
CodSpeed HQ / CodSpeed Performance Analysis succeeded Jun 13, 2026 in 0s

Performance Gate Passed

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 3 improved benchmarks
✅ 17 untouched benchmarks

Performance Changes

Benchmark BASE HEAD Efficiency
test_bench_math_algebraic_expression 1,774.4 µs 874.5 µs ×2
test_bench_math_simple_arithmetic 1,805.6 µs 930.5 µs +94.06%
test_bench_math_identity 13.2 ms 11.3 ms +16.29%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.


Comparing sebastiondev:fix/cwe95-main-sympy-9383 (dc9d4db) with main (06801f6)

Open in CodSpeed