Please feel free to draft a GitHub advisory, and I will work with you to disclose and or resolve the issue responsibly.
If this doesn't seem like the right approach or there are questions, please feel free to reach out to the email used in Sebastian Thiel's commits.
Thank you.