Create an issue and add the label "security" to report a vulnerability. Since this is right now maintained in free time, it might take a while. Providing a detailed description or a pull request with the fix are the best ways to support and speed up the process.