We have contacted upstream. I will forward a mail to the security team with the developer in CC, with also a potential patch on their side to address the issue.