Send an e-mail to the maintainers, eg. @voxpelli through [email protected] Start the subject line with SECURITY:

The maintainers will get back to you as soon as possible and work with you to evaluate and handle the vulnerability.

As none of the maintainers are maintaining this module as part of their day jobs, no promises can be made in how fast a fix can be made.

Whenever feasible a patch version fixing the security vulnerability will be released and the reporting user, unless it wishes to stay anonymous, will be credited for their contribution.