Please do not report security vulnerabilities in public issues.
Report them privately through GitHub: open the Security tab of the affected repository and click Report a vulnerability. Only the maintainers can see the report.
Include the affected component, the architecture (amd64, arm64 or riscv64), the commit or release you tested and the steps to reproduce the problem.