Please report security issues privately through GitHub's private vulnerability reporting — do not open a public issue.

You'll get an acknowledgement and updates as a fix is worked on.