stems is pre-1.0: only the latest release receives security fixes.

Please do not open a public issue. Report it privately through GitHub: open a security advisory (Security tab → "Report a vulnerability").

Include what you found, how to reproduce it and the impact you expect. You'll get an acknowledgement within a week; once a fix is released the advisory is published with credit to you, unless you prefer otherwise.