Credit Chirayu Chiripal for reporting the vulnerability