Please do not open a public issue for security vulnerabilities.
Use GitHub's private vulnerability reporting for this repository: open the Security tab and choose Report a vulnerability. That sends the report privately to the maintainer.
Reports are reviewed and addressed as soon as is reasonably possible.