Please do not open GitHub issues or pull requests - this makes the problem immediately visible to everyone, including malicious actors. Security issues in this open source project can be safely reported via the Meta Bug Bounty program:

https://www.facebook.com/whitehat

Meta's security team will triage your report and determine whether or not is it eligible for a bounty under our program.