Please send a mail describing the vulnerarbility. If you have the means and will to, feel free to prepare a branch containing the security update within you local repository and get in touch about having it merged.