Please report all vulnerabilities to Serban Ghita <serbanghita AT gmail DOT com>.
The usual response time is 1 week for lower impact security reports.

Also add an issue with explanation and links in order to keep track of the fix.

Thank you!