Please do not report a security vulnerability directly on GitHub.
Instead, use this form. This helps us to fix this security issue and release an update before the issue becomes publicly known. This allows other developers to secure their deplyoment by simply updating to our new release when the security issue will be published publicly.
If you have already posted about this security issue on GitHub, please go back, delete the comment and provide all information via this form.