Please report a vulnerability privately through GitHub's "Report a vulnerability" button on this repository's Security tab, not in a public issue. You'll get an answer there.