Please do not open a public issue for a vulnerability.

Report it privately from the affected repository's Security tab ("Report a vulnerability"). Include the steps to reproduce and the impact you expect.