Please do not disclose a vulnerability in a public issue.

Use GitHub's Report a vulnerability flow on the repository Security tab. Include a concise reproduction, affected files or URLs, and the practical impact. Reports will be acknowledged as soon as possible.