Please don't publish details in a public issue or PR, report the vulnerability here.

A maintainer will respond to the report as soon as possible. Typically within 5-10 business days.