Please report vulnerabilities privately using the Report a vulnerability button on the repository's Security tab. Do not open a public issue or pull request.