Weird, Luke's PR to patch this 'terrible bug' has almost universal rejection by the developers within the community.

He posted a CVE, but the only references on there that support this being a bug are the ones he can fabricate (see being a content admin on the referenced wiki).