Please use GitHub's private vulnerability reporting rather than opening a public issue. This keeps the disclosure private until a fix is available.

Expect an initial response within a week. Only the latest released version receives fixes.