Please do not report security problems in public issues. Contact the maintainers listed in package.xml directly. We will answer as soon as we can.