Report a vulnerability privately through GitHub: on the repository's Security tab, choose Report a vulnerability. Please do not open a public issue for it.

Describe what is affected, how to reproduce it and what an attacker could do with it. Fixes go into main and the next release.