Do not open a public issue to report a security vulnerability. Please send a message to [email protected] and we will create a private issue in which the issue can be triaged and handled.