Please don't post details in a public issue. Use GitHub's private vulnerability reporting on this repository, or contact the maintainer directly.

Tell me the version, what an attacker could do, and how to reproduce it. Leave out cookies, tokens and browser profiles.

Only the latest release gets fixes.