Please do not open a public issue. Report it privately through GitHub's vulnerability reporting. We answer within a few working days and publish a fix and an advisory once it is released.