Report a vulnerability in Jason — in the runtime attached to a release, in a plugin, in a skill or in the install scripts — privately, to support@reply.io. Say which version you ran (jason --version), on which platform, and what you saw. Please do not put the details anywhere public.

A fix ships as a release, and its notes say what it fixed once it is out.