If you believe or suspect there is a vulnerability, please privately reporting it via the "Report a vulnerability" button in the "Security and quality" tab.

See the GitHub documentation about privately vulnerability reporting for details.