Please don't report security problems in public issues.

Report them privately instead: open the repository's Security tab and choose Report a vulnerability. If a repository doesn't offer that button, open an issue asking for a private contact, without any details of the problem.

Please include the affected version and the steps to reproduce the problem. Reports are reviewed as soon as possible.