See the security policy for how to report a vulnerability. Please do not open a public issue for it.