Please report security issues via GitHub Security Advisories rather than in public GitHub issues. This lets us fix the issue and prepare a release prior to the vulnerability being publicly disclosed.