Please do not open a public issue for security problems.

Report them privately with GitHub's private vulnerability reporting (the Security tab of the affected repository, then Report a vulnerability).

Include the affected version, steps to reproduce and the impact. We aim to answer within 7 days and to publish a fix and an advisory as soon as it is ready.

Only the latest release of each repository receives security fixes.