This is a security fix. Disclosure following shortly.

Thanks Keryn Knight for the report and initial patch.