Yeah… it was patched in the source 3 days ago. Check the linked GHSA.