Hunk extensions run with the user's full permissions. Please report vulnerabilities privately rather than opening a public issue.

Use GitHub's private vulnerability reporting and include reproduction steps, affected versions, and expected impact when possible.