Thank you to Max Schaefer of GitHub Security Lab for reporting this issue.

1 vulnerability record and advisories credit this contributor.