Give credit to Joost Pol for reporting the security issue.