GHSA-q27q-98j4-9pfv: qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

The qwed package (version 5.1.1) has a critical vulnerability where user-supplied mathematical expressions are passed directly to SymPy's `parse_expr()` function without restrictions. Since `parse_expr()` internally uses Python's `eval()` (a function that runs arbitrary code), any authenticated user can execute malicious Python code on the server, leading to complete compromise. An attacker only needs to create a free account through the signup endpoint to exploit this.