GHSA-mw6r-2hvm-4rp2: qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

qwed-mcp v0.2.0 has a critical remote code execution vulnerability in the `verify_math_expression()` function, which passes user input directly to SymPy's `parse_expr()` without restricting access to Python's built-in functions. Because `parse_expr()` internally calls `eval()` and does not explicitly block `__builtins__`, an attacker can embed arbitrary Python code (like `__import__('os').system()`) to execute OS commands with the privileges of the running process, including root access in containers.