Please do not open a public issue for security vulnerabilities.

Use GitHub's private vulnerability reporting to report the issue privately. Include a description of the problem, steps to reproduce, and any suggested fix if you have one.

I will acknowledge the report as soon as I can and work with you on a disclosure timeline.