Please do not open a public issue for security vulnerabilities.

Use GitHub's private vulnerability reporting for this repository: open the Security tab and choose Report a vulnerability. That sends the report privately to the maintainer.

Reports are reviewed and addressed as soon as is reasonably possible.