Please do not open a public issue for security problems.

Instead, use GitHub's private vulnerability reporting: Security tab → Report a vulnerability.

You should get a response within a few days. Once the issue is confirmed, a fix will be prepared and you'll be credited in the advisory if you wish.