Please report vulnerabilities privately using Voder's canonical security page. Do not disclose a suspected vulnerability in a public issue.