Please file a private vulnerability report via GitHub, or email @ljharb, if you have a potential security vulnerability to report.