Yes, that's a vulnerability, I have fixed it on github.