Please use GitHub's Private Vulnerability Reporting instead of opening a public issue.

1. Create a private report via the Security tab
2. Include details and steps to reproduce the vulnerability
3. We will acknowledge the report within 7 days

Please do not disclose vulnerability details until a fix has been released.