Security fixes go into the latest release only. Update to it before reporting.

Please do not open a public issue. Report it privately through GitHub's vulnerability reporting. You will get an answer within a week.