Please report security issues in this plugin privately, not in a public issue:

Report a vulnerability (GitHub → Security → Report a vulnerability)

Include what an attacker controls (a note, a vault, a file on disk), what they get, and the steps or a sample note that shows it. You'll get a reply within a week; once a fix is released the advisory is published with credit to you, unless you'd rather stay anonymous.

Supported: the latest release only — fixes ship as a new version, not as patches to old ones.