Please don't report security issues in public issues or discussions. Report them privately through GitHub's private vulnerability reporting, with steps or a dataset to reproduce and the affected version.

You can expect a reply within a week. Fixes go into the latest release of kiln-render and the hosted viewer at kilnrender.com.