Please don't report a vulnerability in a public issue. Report it privately on GitHub: on the repository's Security tab, choose Report a vulnerability (direct link).

Say what you found, how to reproduce it, and what it lets someone do. The answer comes in that report.

Study is pre-release: fixes go to main and the next release only.