v0.2.1 - Critical Security Patch & PyJWT Update

🚨 Critical Security Release

This patch release addresses GHSA-mw6r-2hvm-4rp2 (CWE-94), a critical Remote Code Execution (RCE) vulnerability in the math verification engine reported responsibly by EQSTLab (@EQSTLab).

All users of qwed-mcp MUST upgrade to v0.2.1 immediately.

Security Fixes

• Math Engine RCE (CWE-94): Replaced all bare parse_expr() calls with a hardened safe_parse_expr() wrapper. This wrapper strips Python __builtins__, enforces a strict regex denylist, restricts the global_dict, and isolates the evaluation namespace. This completely prevents attackers from injecting malicious Python constructs (like __import__('os').system) into mathematical expression evaluation.
• Dependency Vulnerability: Bumped PyJWT from >=2.12.0 to >=2.13.0 to resolve an upstream algorithm confusion vulnerability (CVE pending for PyJWT).

Other Changes

• Synced requirements.txt with pyproject.toml dependencies
• Updated uv.lock for deterministic and secure Docker builds
• Fixed README documentation references to reflect the correct release milestone

Upgrading

# Using pip
pip install --upgrade qwed-mcp

# Using uv
uv pip install --upgrade qwed-mcp

Note: A huge thanks to the team at EQSTLab (@EQSTLab) for their diligent research and responsible disclosure of the core vulnerability.